You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ji...@apache.org on 2026/09/04 18:04:23 UTC
(geode) branch support/1.15 updated: GEODE-10628: Remediation of CVE-2026-59296 (#8057)
This is an automated email from the ASF dual-hosted git repository.
JinwooHwang pushed a commit to branch support/1.15
in repository https://gitbox.apache.org/repos/asf/geode.git
The following commit(s) were added to refs/heads/support/1.15 by this push:
new 6bf8c5f714 GEODE-10628: Remediation of CVE-2026-59296 (#8057)
6bf8c5f714 is described below
commit 6bf8c5f714cf965ef8995ea6a52979b3de3223a0
Author: Jinwoo Hwang <92...@users.noreply.github.com>
AuthorDate: Fri Sep 4 14:04:18 2026 -0400
GEODE-10628: Remediation of CVE-2026-59296 (#8057)
---
boms/geode-all-bom/src/test/resources/expected-pom.xml | 2 +-
.../org/apache/geode/gradle/plugins/DependencyConstraints.groovy | 2 +-
geode-assembly/src/integrationTest/resources/assembly_content.txt | 7 +++++--
geode-assembly/src/integrationTest/resources/expected_jars.txt | 3 +++
.../src/integrationTest/resources/gfsh_dependency_classpath.txt | 7 +++++--
.../java/org/apache/geode/metrics/internal/NoopMeterRegistry.java | 6 +++---
.../internal/cli/commands/lifecycle/StopServerCommand.java | 2 +-
.../src/integrationTest/resources/dependency_classpath.txt | 7 +++++--
8 files changed, 24 insertions(+), 12 deletions(-)
diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml
index f3c9182a59..e6d9b7401a 100644
--- a/boms/geode-all-bom/src/test/resources/expected-pom.xml
+++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml
@@ -195,7 +195,7 @@
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-core</artifactId>
- <version>1.9.0</version>
+ <version>1.16.7</version>
</dependency>
<dependency>
<groupId>io.swagger.core.v3</groupId>
diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
index 1a56bc1892..8c121628a6 100644
--- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
+++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
@@ -40,7 +40,7 @@ class DependencyConstraints {
deps.put("javax.transaction-api.version", "1.3")
deps.put("jgroups.version", "3.6.20.Final")
deps.put("log4j.version", "2.25.5")
- deps.put("micrometer.version", "1.9.1")
+ deps.put("micrometer.version", "1.16.7")
deps.put("shiro.version", "1.13.0")
deps.put("slf4j-api.version", "1.7.36")
deps.put("jboss-modules.version", "1.11.0.Final")
diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt
index 9c828e0bca..b27e4e4795 100644
--- a/geode-assembly/src/integrationTest/resources/assembly_content.txt
+++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt
@@ -963,7 +963,7 @@ javadoc/package-list
javadoc/script.js
javadoc/serialized-form.html
javadoc/stylesheet.css
-lib/HdrHistogram-2.1.12.jar
+lib/HdrHistogram-2.2.2.jar
lib/HikariCP-4.0.3.jar
lib/LatencyUtils-2.0.3.jar
lib/antlr-2.7.7.jar
@@ -1031,6 +1031,7 @@ lib/jna-5.11.0.jar
lib/jna-platform-5.11.0.jar
lib/joda-time-2.12.7.jar
lib/jopt-simple-5.0.4.jar
+lib/jspecify-1.0.1.jar
lib/log4j-api-2.25.5.jar
lib/log4j-core-2.25.5.jar
lib/log4j-jcl-2.25.5.jar
@@ -1041,7 +1042,9 @@ lib/lucene-analyzers-phonetic-6.6.6.jar
lib/lucene-core-6.6.6.jar
lib/lucene-queries-6.6.6.jar
lib/lucene-queryparser-6.6.6.jar
-lib/micrometer-core-1.9.0.jar
+lib/micrometer-commons-1.16.7.jar
+lib/micrometer-core-1.16.7.jar
+lib/micrometer-observation-1.16.7.jar
lib/mx4j-3.0.2.jar
lib/mx4j-remote-3.0.2.jar
lib/mx4j-tools-3.0.1.jar
diff --git a/geode-assembly/src/integrationTest/resources/expected_jars.txt b/geode-assembly/src/integrationTest/resources/expected_jars.txt
index 674930cfdd..a1d8b68c97 100644
--- a/geode-assembly/src/integrationTest/resources/expected_jars.txt
+++ b/geode-assembly/src/integrationTest/resources/expected_jars.txt
@@ -56,6 +56,7 @@ joda-time
jopt-simple
json-path
json-smart
+jspecify
lang-tag
log4j-api
log4j-core
@@ -67,7 +68,9 @@ lucene-analyzers-phonetic
lucene-core
lucene-queries
lucene-queryparser
+micrometer-commons
micrometer-core
+micrometer-observation
mx4j
mx4j-remote
mx4j-tools
diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
index edb139047b..8cfee305aa 100644
--- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
+++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
@@ -56,7 +56,7 @@ commons-digester-2.1.jar
commons-io-2.11.0.jar
commons-logging-1.2.jar
classgraph-4.8.146.jar
-micrometer-core-1.9.0.jar
+micrometer-core-1.16.7.jar
fastutil-8.5.8.jar
javax.resource-api-1.7.1.jar
jetty-webapp-9.4.57.v20241219.jar
@@ -82,7 +82,10 @@ javax.activation-api-1.2.0.jar
jline-2.12.jar
lucene-queries-6.6.6.jar
spring-jcl-5.3.20.jar
-HdrHistogram-2.1.12.jar
+micrometer-commons-1.16.7.jar
+micrometer-observation-1.16.7.jar
+jspecify-1.0.1.jar
+HdrHistogram-2.2.2.jar
LatencyUtils-2.0.3.jar
javax.transaction-api-1.3.jar
jetty-xml-9.4.57.v20241219.jar
diff --git a/geode-core/src/main/java/org/apache/geode/metrics/internal/NoopMeterRegistry.java b/geode-core/src/main/java/org/apache/geode/metrics/internal/NoopMeterRegistry.java
index bd70d1d992..0056fd51a6 100644
--- a/geode-core/src/main/java/org/apache/geode/metrics/internal/NoopMeterRegistry.java
+++ b/geode-core/src/main/java/org/apache/geode/metrics/internal/NoopMeterRegistry.java
@@ -39,13 +39,13 @@ import io.micrometer.core.instrument.noop.NoopGauge;
import io.micrometer.core.instrument.noop.NoopLongTaskTimer;
import io.micrometer.core.instrument.noop.NoopMeter;
import io.micrometer.core.instrument.noop.NoopTimer;
-import io.micrometer.core.lang.NonNullApi;
-import io.micrometer.core.lang.Nullable;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
import org.apache.geode.annotations.Immutable;
import org.apache.geode.annotations.VisibleForTesting;
-@NonNullApi
+@NullMarked
public class NoopMeterRegistry extends MeterRegistry {
@Immutable
diff --git a/geode-gfsh/src/main/java/org/apache/geode/management/internal/cli/commands/lifecycle/StopServerCommand.java b/geode-gfsh/src/main/java/org/apache/geode/management/internal/cli/commands/lifecycle/StopServerCommand.java
index e6277852f9..5aa71c3ff0 100644
--- a/geode-gfsh/src/main/java/org/apache/geode/management/internal/cli/commands/lifecycle/StopServerCommand.java
+++ b/geode-gfsh/src/main/java/org/apache/geode/management/internal/cli/commands/lifecycle/StopServerCommand.java
@@ -14,7 +14,7 @@
*/
package org.apache.geode.management.internal.cli.commands.lifecycle;
-import static io.micrometer.core.instrument.util.StringUtils.isNotBlank;
+import static org.apache.commons.lang3.StringUtils.isNotBlank;
import static org.apache.geode.management.internal.cli.shell.MXBeanProvider.getMemberMXBean;
import java.util.concurrent.TimeUnit;
diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
index f1827c9209..639cc660cc 100644
--- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
+++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
@@ -70,9 +70,12 @@ spring-shell-1.2.0.RELEASE.jar
jaxb-impl-2.3.2.jar
jna-platform-5.11.0.jar
log4j-jul-2.25.5.jar
-HdrHistogram-2.1.12.jar
+HdrHistogram-2.2.2.jar
jackson-annotations-2.21.jar
-micrometer-core-1.9.1.jar
+micrometer-commons-1.16.7.jar
+micrometer-core-1.16.7.jar
+micrometer-observation-1.16.7.jar
+jspecify-1.0.1.jar
shiro-config-ogdl-1.13.0.jar
geode-log4j-0.0.0.jar
lucene-analyzers-phonetic-6.6.6.jar