Skip to content

fix(FFESUPPORT-1065): remediate October 2026 vulnerabilities #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aarsilv wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(FFESUPPORT-1065): remediate October 2026 vulnerabilities #164

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
878a43d
test(FFESUPPORT-1065): bump junit-bom to 5.14.4
aarsilv Oct 29, 2026
77eb2d0
chore(FFESUPPORT-1065): bump jreleaser Gradle plugin to 1.26.0
aarsilv Oct 29, 2026
c6ab65c
chore(FFESUPPORT-1065): bump Gradle wrapper to 8.14.6
aarsilv Oct 29, 2026
c1c7d7b
chore(FFESUPPORT-1065): constrain jreleaser dependencies with advisories
aarsilv Oct 29, 2026
ab012b6
test(FFESUPPORT-1065): replace logback with slf4j-simple in tests
aarsilv Oct 29, 2026
e6aba6d
chore(FFESUPPORT-1065): ignore Gradle wrapper major updates
aarsilv Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,7 @@ updates:
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
ignore:
# Gradle 9 requires Java 17 to run. CI runs Gradle on Java 8 and 11.
- dependency-name: "gradle-wrapper"
update-types: ["version-update:semver-major"]
19 changes: 15 additions & 4 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,18 @@
buildscript {
dependencies {
// jreleaser 1.26.0 pulls older versions with known advisories. Remove once it pulls these.
constraints {

@aarsilv aarsilv Oct 29, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Context from Claude:

Gradle requires buildscript {} before plugins {}. Constraints here also apply to plugins that the plugins {} block resolves, such as jreleaser.

To check them, run ./gradlew buildEnvironment. Each constrained module shows an arrow, for example org.codehaus.plexus:plexus-utils:3.2.1 -> 3.6.1. When a jreleaser upgrade pulls a version at or above a constraint, that arrow goes away. Then delete that line.

PR CI does not run jreleaser tasks. After a change to this block, run the publish steps with --dryrun, or watch the next publish workflow.

classpath 'com.fasterxml.jackson.core:jackson-databind:2.22.3'
classpath 'org.apache.httpcomponents.client5:httpclient5:5.6.3'
classpath 'org.codehaus.plexus:plexus-utils:3.6.1'
}
}
}

plugins {
id 'java-library'
id 'maven-publish'
id 'org.jreleaser' version '1.21.0'
id 'org.jreleaser' version '1.26.0'
id "com.diffplug.spotless" version "6.13.0"
}

Expand Down Expand Up @@ -38,11 +49,11 @@ dependencies {
implementation 'org.slf4j:slf4j-api:2.0.17'
implementation 'org.jetbrains:annotations:26.1.0'

// Logback classic 1.3.x is compatible with java 8 - only needed for tests
testImplementation 'cloud.eppo:eppo-sdk-framework:0.1.0-SNAPSHOT:tests'
testImplementation 'ch.qos.logback:logback-classic:1.3.16'
testImplementation platform('org.junit:junit-bom:5.11.4')
testImplementation 'org.slf4j:slf4j-simple:2.0.17'
testImplementation platform('org.junit:junit-bom:5.14.4')
testImplementation 'org.junit.jupiter:junit-jupiter'
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
testImplementation 'com.github.tomakehurst:wiremock-jre8:2.35.2'
testImplementation 'org.mockito:mockito-core:4.11.0'
testImplementation 'com.squareup.okhttp3:okhttp:4.12.0'
Expand Down
Binary file modified gradle/wrapper/gradle-wrapper.jar
View file
Open in desktop
Binary file not shown.
5 changes: 3 additions & 2 deletions gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
#Thu Jun 06 13:59:33 PDT 2024
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.6-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
47 changes: 32 additions & 15 deletions gradlew
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

41 changes: 23 additions & 18 deletions gradlew.bat
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 0 additions & 11 deletions src/test/resources/logback-test.xml
View file
Open in desktop

This file was deleted.

11 changes: 0 additions & 11 deletions src/test/resources/logback.xml
View file
Open in desktop

This file was deleted.

6 changes: 6 additions & 0 deletions src/test/resources/simplelogger.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
org.slf4j.simpleLogger.defaultLogLevel=debug
org.slf4j.simpleLogger.showDateTime=true
org.slf4j.simpleLogger.dateTimeFormat=HH:mm:ss.SSS
org.slf4j.simpleLogger.showThreadName=false
org.slf4j.simpleLogger.showLogName=false
org.slf4j.simpleLogger.logFile=System.out
Loading