From 81a6f59b68da9d3ec3fa8b1f5343ef3883d371bb Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Wed, 30 Sep 2026 00:48:52 -0400 Subject: [PATCH 1/6] Share versions across library families in the version catalog Every catalog entry carried its own inline version, so single-artifact bumps (mostly Renovate security PRs) left families split across versions: jackson-core, netty-codec and derby were each bumped alone, and log4j-core was once bumped without log4j-api, breaking the build. Move each family whose versions currently agree onto a shared [versions] ref so a bump moves the whole family. No version changes: the resolved dependency trees for every project and classpath are identical before and after. The artifacts that have already drifted keep their inline versions, with a comment, until they are realigned. jackson-core's comment records why the Jackson family cannot simply be realigned: databind 2.16 and later remove APIs that swagger-core 2.0.10 and the AWS SDK 2.15.28 regions module still call, so the family stays split until those callers are upgraded. Signed-off-by: Tony Germano --- gradle/libs.versions.toml | 264 ++++++++++++++++++++++---------------- 1 file changed, 152 insertions(+), 112 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 8a81742e0..f956041dc 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -2,28 +2,58 @@ # matches against Maven Central). Versions match the vendored jars # byte for byte; see gradle/vendored-layout.json for placement. +[versions] +# Shared by artifacts released together; bump the whole family at once. +asm = "9.6" +aws-sdk = "2.15.28" +bouncycastle = "1.78.1" +byte-buddy = "1.14.13" +flying-saucer = "9.0.1" +hapi = "2.3" +hk2 = "2.4.0-b31" +httpclient = "4.5.13" +itext = "2.1.7" +# do not bump past 2.15.x before reading the note on jackson-core +jackson = "2.14.3" +jasper = "8.5.70" +jaxb-ri = "2.4.0-b180725.0644" +jaxws-ri = "2.3.0.2" +jersey = "2.22.1" +jetty = "9.4.57.v20241219" +jna = "4.5.2" +log4j = "2.26.1" +miglayout = "4.2" +mockito = "5.1.1" +netty = "4.1.119.Final" +netty-reactive-streams = "2.0.8" +openhtmltopdf = "1.0.9" +pdfbox = "2.0.24" +slf4j = "1.7.30" +swagger = "2.0.10" +taglibs = "1.2.5" + [libraries] -annotations = { module = "software.amazon.awssdk:annotations", version = "2.15.28" } -aopalliance-repackaged = { module = "org.glassfish.hk2.external:aopalliance-repackaged", version = "2.4.0-b31" } -apache-client = { module = "software.amazon.awssdk:apache-client", version = "2.15.28" } -apache-el = { module = "org.mortbay.jasper:apache-el", version = "8.5.70" } -apache-jsp = { module = "org.eclipse.jetty:apache-jsp", version = "9.4.57.v20241219" } -apache-jsp-v8-5-70 = { module = "org.mortbay.jasper:apache-jsp", version = "8.5.70" } -asm = { module = "org.ow2.asm:asm", version = "9.6" } -asm-analysis = { module = "org.ow2.asm:asm-analysis", version = "9.6" } -asm-commons = { module = "org.ow2.asm:asm-commons", version = "9.6" } -asm-tree = { module = "org.ow2.asm:asm-tree", version = "9.6" } -asm-util = { module = "org.ow2.asm:asm-util", version = "9.6" } -auth = { module = "software.amazon.awssdk:auth", version = "2.15.28" } -aws-core = { module = "software.amazon.awssdk:aws-core", version = "2.15.28" } -aws-json-protocol = { module = "software.amazon.awssdk:aws-json-protocol", version = "2.15.28" } -aws-query-protocol = { module = "software.amazon.awssdk:aws-query-protocol", version = "2.15.28" } -aws-xml-protocol = { module = "software.amazon.awssdk:aws-xml-protocol", version = "2.15.28" } -bcpkix-jdk18on = { module = "org.bouncycastle:bcpkix-jdk18on", version = "1.78.1" } -bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version = "1.78.1" } -bcutil-jdk18on = { module = "org.bouncycastle:bcutil-jdk18on", version = "1.78.1" } -byte-buddy = { module = "net.bytebuddy:byte-buddy", version = "1.14.13" } -byte-buddy-agent = { module = "net.bytebuddy:byte-buddy-agent", version = "1.14.13" } +annotations = { module = "software.amazon.awssdk:annotations", version.ref = "aws-sdk" } +aopalliance-repackaged = { module = "org.glassfish.hk2.external:aopalliance-repackaged", version.ref = "hk2" } +apache-client = { module = "software.amazon.awssdk:apache-client", version.ref = "aws-sdk" } +apache-el = { module = "org.mortbay.jasper:apache-el", version.ref = "jasper" } +apache-jsp = { module = "org.eclipse.jetty:apache-jsp", version.ref = "jetty" } +apache-jsp-v8-5-70 = { module = "org.mortbay.jasper:apache-jsp", version.ref = "jasper" } +asm = { module = "org.ow2.asm:asm", version.ref = "asm" } +asm-analysis = { module = "org.ow2.asm:asm-analysis", version.ref = "asm" } +asm-commons = { module = "org.ow2.asm:asm-commons", version.ref = "asm" } +asm-tree = { module = "org.ow2.asm:asm-tree", version.ref = "asm" } +asm-util = { module = "org.ow2.asm:asm-util", version.ref = "asm" } +auth = { module = "software.amazon.awssdk:auth", version.ref = "aws-sdk" } +aws-core = { module = "software.amazon.awssdk:aws-core", version.ref = "aws-sdk" } +aws-json-protocol = { module = "software.amazon.awssdk:aws-json-protocol", version.ref = "aws-sdk" } +aws-query-protocol = { module = "software.amazon.awssdk:aws-query-protocol", version.ref = "aws-sdk" } +aws-xml-protocol = { module = "software.amazon.awssdk:aws-xml-protocol", version.ref = "aws-sdk" } +bcpkix-jdk18on = { module = "org.bouncycastle:bcpkix-jdk18on", version.ref = "bouncycastle" } +bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "bouncycastle" } +bcutil-jdk18on = { module = "org.bouncycastle:bcutil-jdk18on", version.ref = "bouncycastle" } +byte-buddy = { module = "net.bytebuddy:byte-buddy", version.ref = "byte-buddy" } +byte-buddy-agent = { module = "net.bytebuddy:byte-buddy-agent", version.ref = "byte-buddy" } checker-qual = { module = "org.checkerframework:checker-qual", version = "2.10.0" } classgraph = { module = "io.github.classgraph:classgraph", version = "4.8.179" } commons-beanutils = { module = "commons-beanutils:commons-beanutils", version = "1.11.0" } @@ -50,15 +80,16 @@ commons-pool2 = { module = "org.apache.commons:commons-pool2", version = "2.3" } commons-text = { module = "org.apache.commons:commons-text", version = "1.15.0" } commons-vfs2 = { module = "org.apache.commons:commons-vfs2", version = "2.10.0" } derby = { module = "org.apache.derby:derby", version = "10.11.1.1" } +# not on a shared ref with derby: derby was bumped alone for a security fix derbytools = { module = "org.apache.derby:derbytools", version = "10.10.2.0" } ecj = { module = "org.eclipse.jdt:ecj", version = "3.19.0" } error-prone-annotations = { module = "com.google.errorprone:error_prone_annotations", version = "2.3.4" } eventstream = { module = "software.amazon.eventstream:eventstream", version = "1.0.1" } failureaccess = { module = "com.google.guava:failureaccess", version = "1.0.1" } fastinfoset = { module = "com.sun.xml.fastinfoset:FastInfoset", version = "1.2.13" } -flying-saucer-core = { module = "org.xhtmlrenderer:flying-saucer-core", version = "9.0.1" } -flying-saucer-pdf = { module = "org.xhtmlrenderer:flying-saucer-pdf", version = "9.0.1" } -fontbox = { module = "org.apache.pdfbox:fontbox", version = "2.0.24" } +flying-saucer-core = { module = "org.xhtmlrenderer:flying-saucer-core", version.ref = "flying-saucer" } +flying-saucer-pdf = { module = "org.xhtmlrenderer:flying-saucer-pdf", version.ref = "flying-saucer" } +fontbox = { module = "org.apache.pdfbox:fontbox", version.ref = "pdfbox" } geronimo-j2ee-management-1-1-spec = { module = "org.apache.geronimo.specs:geronimo-j2ee-management_1.1_spec", version = "1.0.1" } geronimo-jms-1-1-spec = { module = "org.apache.geronimo.specs:geronimo-jms_1.1_spec", version = "1.1.1" } gmbal-api-only = { module = "org.glassfish.gmbal:gmbal-api-only", version = "3.1.0-b001" } @@ -67,27 +98,34 @@ guava = { module = "com.google.guava:guava", version = "32.0.1-jre" } guice = { module = "com.google.inject:guice", version = "4.1.0" } ha-api = { module = "org.glassfish.ha:ha-api", version = "3.1.9" } hamcrest = { module = "org.hamcrest:hamcrest", version = "2.2" } -hapi-structures-v27 = { module = "ca.uhn.hapi:hapi-structures-v27", version = "2.3" } -hapi-structures-v28 = { module = "ca.uhn.hapi:hapi-structures-v28", version = "2.3" } -hapi-structures-v281 = { module = "ca.uhn.hapi:hapi-structures-v281", version = "2.3" } +hapi-structures-v27 = { module = "ca.uhn.hapi:hapi-structures-v27", version.ref = "hapi" } +hapi-structures-v28 = { module = "ca.uhn.hapi:hapi-structures-v28", version.ref = "hapi" } +hapi-structures-v281 = { module = "ca.uhn.hapi:hapi-structures-v281", version.ref = "hapi" } hikaricp = { module = "com.zaxxer:HikariCP", version = "2.5.1" } -hk2-api = { module = "org.glassfish.hk2:hk2-api", version = "2.4.0-b31" } -hk2-locator = { module = "org.glassfish.hk2:hk2-locator", version = "2.4.0-b31" } -hk2-utils = { module = "org.glassfish.hk2:hk2-utils", version = "2.4.0-b31" } -http-client-spi = { module = "software.amazon.awssdk:http-client-spi", version = "2.15.28" } -httpclient = { module = "org.apache.httpcomponents:httpclient", version = "4.5.13" } +hk2-api = { module = "org.glassfish.hk2:hk2-api", version.ref = "hk2" } +hk2-locator = { module = "org.glassfish.hk2:hk2-locator", version.ref = "hk2" } +hk2-utils = { module = "org.glassfish.hk2:hk2-utils", version.ref = "hk2" } +http-client-spi = { module = "software.amazon.awssdk:http-client-spi", version.ref = "aws-sdk" } +httpclient = { module = "org.apache.httpcomponents:httpclient", version.ref = "httpclient" } httpcore = { module = "org.apache.httpcomponents:httpcore", version = "4.4.13" } -httpmime = { module = "org.apache.httpcomponents:httpmime", version = "4.5.13" } +httpmime = { module = "org.apache.httpcomponents:httpmime", version.ref = "httpclient" } imagej = { module = "gov.nih.imagej:imagej", version = "1.42" } -itext = { module = "com.lowagie:itext", version = "2.1.7" } -itext-rtf = { module = "com.lowagie:itext-rtf", version = "2.1.7" } +itext = { module = "com.lowagie:itext", version.ref = "itext" } +itext-rtf = { module = "com.lowagie:itext-rtf", version.ref = "itext" } j2objc-annotations = { module = "com.google.j2objc:j2objc-annotations", version = "1.3" } -jackson-annotations = { module = "com.fasterxml.jackson.core:jackson-annotations", version = "2.14.3" } +jackson-annotations = { module = "com.fasterxml.jackson.core:jackson-annotations", version.ref = "jackson" } +# off the jackson ref: bumped alone for a security fix. Realigning the +# family is blocked: databind 2.16 and later remove APIs that +# swagger-core 2.0.10 (BeanDescription.findJsonValueMethod, +# AnnotationIntrospector.findPropertiesToIgnore) and AWS SDK 2.15.28 +# regions (PropertyNamingStrategy.PASCAL_CASE_TO_CAMEL_CASE) still call, +# failing at runtime with NoSuchMethodError/NoSuchFieldError. Upgrade +# those callers first. jackson-core = { module = "com.fasterxml.jackson.core:jackson-core", version = "2.18.8" } -jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version = "2.14.3" } -jackson-dataformat-cbor = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor", version = "2.14.3" } -jackson-dataformat-yaml = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml", version = "2.14.3" } -jackson-datatype-jsr310 = { module = "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", version = "2.14.3" } +jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "jackson" } +jackson-dataformat-cbor = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor", version.ref = "jackson" } +jackson-dataformat-yaml = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml", version.ref = "jackson" } +jackson-datatype-jsr310 = { module = "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", version.ref = "jackson" } jakarta-activation = { module = "com.sun.activation:jakarta.activation", version = "1.2.1" } jakarta-mail = { module = "com.sun.mail:jakarta.mail", version = "1.6.8" } java-semver = { module = "com.github.zafarkhaja:java-semver", version = "0.10.2" } @@ -95,124 +133,126 @@ javassist = { module = "org.javassist:javassist", version = "3.26.0-GA" } javax-activation-api = { module = "javax.activation:javax.activation-api", version = "1.2.0" } javax-annotation-api = { module = "javax.annotation:javax.annotation-api", version = "1.3.2" } javax-annotation-api-v1-3 = { module = "javax.annotation:javax.annotation-api", version = "1.3" } -javax-inject = { module = "org.glassfish.hk2.external:javax.inject", version = "2.4.0-b31" } +javax-inject = { module = "org.glassfish.hk2.external:javax.inject", version.ref = "hk2" } javax-json = { module = "org.glassfish:javax.json", version = "1.0.4" } javax-json-api = { module = "javax.json:javax.json-api", version = "1.0" } javax-servlet-api = { module = "javax.servlet:javax.servlet-api", version = "3.1.0" } javax-ws-rs-api = { module = "javax.ws.rs:javax.ws.rs-api", version = "2.0.1" } javax-xml-soap-api = { module = "javax.xml.soap:javax.xml.soap-api", version = "1.4.0" } jaxb-api = { module = "javax.xml.bind:jaxb-api", version = "2.4.0-b180725.0427" } -jaxb-runtime = { module = "org.glassfish.jaxb:jaxb-runtime", version = "2.4.0-b180725.0644" } +jaxb-runtime = { module = "org.glassfish.jaxb:jaxb-runtime", version.ref = "jaxb-ri" } jaxws-api = { module = "javax.xml.ws:jaxws-api", version = "2.3.0" } -jaxws-rt = { module = "com.sun.xml.ws:jaxws-rt", version = "2.3.0.2" } -jaxws-tools = { module = "com.sun.xml.ws:jaxws-tools", version = "2.3.0.2" } +jaxws-rt = { module = "com.sun.xml.ws:jaxws-rt", version.ref = "jaxws-ri" } +jaxws-tools = { module = "com.sun.xml.ws:jaxws-tools", version.ref = "jaxws-ri" } jcifs-ng = { module = "eu.agno3.jcifs:jcifs-ng", version = "2.1.10" } jdom2 = { module = "org.jdom:jdom2", version = "2.0.6.1" } -jersey-client = { module = "org.glassfish.jersey.core:jersey-client", version = "2.22.1" } -jersey-common = { module = "org.glassfish.jersey.core:jersey-common", version = "2.22.1" } -jersey-container-jetty-http = { module = "org.glassfish.jersey.containers:jersey-container-jetty-http", version = "2.22.1" } -jersey-container-jetty-servlet = { module = "org.glassfish.jersey.containers:jersey-container-jetty-servlet", version = "2.22.1" } -jersey-container-servlet = { module = "org.glassfish.jersey.containers:jersey-container-servlet", version = "2.22.1" } -jersey-container-servlet-core = { module = "org.glassfish.jersey.containers:jersey-container-servlet-core", version = "2.22.1" } -jersey-guava = { module = "org.glassfish.jersey.bundles.repackaged:jersey-guava", version = "2.22.1" } -jersey-media-jaxb = { module = "org.glassfish.jersey.media:jersey-media-jaxb", version = "2.22.1" } -jersey-media-multipart = { module = "org.glassfish.jersey.media:jersey-media-multipart", version = "2.22.1" } -jersey-proxy-client = { module = "org.glassfish.jersey.ext:jersey-proxy-client", version = "2.22.1" } -jersey-server = { module = "org.glassfish.jersey.core:jersey-server", version = "2.22.1" } -jetty-annotations = { module = "org.eclipse.jetty:jetty-annotations", version = "9.4.57.v20241219" } -jetty-continuation = { module = "org.eclipse.jetty:jetty-continuation", version = "9.4.57.v20241219" } -jetty-http = { module = "org.eclipse.jetty:jetty-http", version = "9.4.57.v20241219" } -jetty-io = { module = "org.eclipse.jetty:jetty-io", version = "9.4.57.v20241219" } -jetty-jndi = { module = "org.eclipse.jetty:jetty-jndi", version = "9.4.57.v20241219" } -jetty-plus = { module = "org.eclipse.jetty:jetty-plus", version = "9.4.57.v20241219" } -jetty-rewrite = { module = "org.eclipse.jetty:jetty-rewrite", version = "9.4.57.v20241219" } +jersey-client = { module = "org.glassfish.jersey.core:jersey-client", version.ref = "jersey" } +jersey-common = { module = "org.glassfish.jersey.core:jersey-common", version.ref = "jersey" } +jersey-container-jetty-http = { module = "org.glassfish.jersey.containers:jersey-container-jetty-http", version.ref = "jersey" } +jersey-container-jetty-servlet = { module = "org.glassfish.jersey.containers:jersey-container-jetty-servlet", version.ref = "jersey" } +jersey-container-servlet = { module = "org.glassfish.jersey.containers:jersey-container-servlet", version.ref = "jersey" } +jersey-container-servlet-core = { module = "org.glassfish.jersey.containers:jersey-container-servlet-core", version.ref = "jersey" } +jersey-guava = { module = "org.glassfish.jersey.bundles.repackaged:jersey-guava", version.ref = "jersey" } +jersey-media-jaxb = { module = "org.glassfish.jersey.media:jersey-media-jaxb", version.ref = "jersey" } +jersey-media-multipart = { module = "org.glassfish.jersey.media:jersey-media-multipart", version.ref = "jersey" } +jersey-proxy-client = { module = "org.glassfish.jersey.ext:jersey-proxy-client", version.ref = "jersey" } +jersey-server = { module = "org.glassfish.jersey.core:jersey-server", version.ref = "jersey" } +jetty-annotations = { module = "org.eclipse.jetty:jetty-annotations", version.ref = "jetty" } +jetty-continuation = { module = "org.eclipse.jetty:jetty-continuation", version.ref = "jetty" } +jetty-http = { module = "org.eclipse.jetty:jetty-http", version.ref = "jetty" } +jetty-io = { module = "org.eclipse.jetty:jetty-io", version.ref = "jetty" } +jetty-jndi = { module = "org.eclipse.jetty:jetty-jndi", version.ref = "jetty" } +jetty-plus = { module = "org.eclipse.jetty:jetty-plus", version.ref = "jetty" } +jetty-rewrite = { module = "org.eclipse.jetty:jetty-rewrite", version.ref = "jetty" } jetty-schemas = { module = "org.eclipse.jetty.toolchain:jetty-schemas", version = "3.1.2" } -jetty-security = { module = "org.eclipse.jetty:jetty-security", version = "9.4.57.v20241219" } -jetty-server = { module = "org.eclipse.jetty:jetty-server", version = "9.4.57.v20241219" } -jetty-servlet = { module = "org.eclipse.jetty:jetty-servlet", version = "9.4.57.v20241219" } -jetty-util = { module = "org.eclipse.jetty:jetty-util", version = "9.4.57.v20241219" } -jetty-util-ajax = { module = "org.eclipse.jetty:jetty-util-ajax", version = "9.4.57.v20241219" } -jetty-webapp = { module = "org.eclipse.jetty:jetty-webapp", version = "9.4.57.v20241219" } -jetty-xml = { module = "org.eclipse.jetty:jetty-xml", version = "9.4.57.v20241219" } -jna = { module = "net.java.dev.jna:jna", version = "4.5.2" } -jna-platform = { module = "net.java.dev.jna:jna-platform", version = "4.5.2" } +jetty-security = { module = "org.eclipse.jetty:jetty-security", version.ref = "jetty" } +jetty-server = { module = "org.eclipse.jetty:jetty-server", version.ref = "jetty" } +jetty-servlet = { module = "org.eclipse.jetty:jetty-servlet", version.ref = "jetty" } +jetty-util = { module = "org.eclipse.jetty:jetty-util", version.ref = "jetty" } +jetty-util-ajax = { module = "org.eclipse.jetty:jetty-util-ajax", version.ref = "jetty" } +jetty-webapp = { module = "org.eclipse.jetty:jetty-webapp", version.ref = "jetty" } +jetty-xml = { module = "org.eclipse.jetty:jetty-xml", version.ref = "jetty" } +jna = { module = "net.java.dev.jna:jna", version.ref = "jna" } +jna-platform = { module = "net.java.dev.jna:jna-platform", version.ref = "jna" } joda-time = { module = "joda-time:joda-time", version = "2.9.9" } jsr181-api = { module = "javax.jws:jsr181-api", version = "1.0-MR1" } jsr305 = { module = "com.google.code.findbugs:jsr305", version = "3.0.2" } junit = { module = "junit:junit", version = "4.8.1" } junit-v4-13-1 = { module = "junit:junit", version = "4.13.1" } junit-platform-console-standalone = { module = "org.junit.platform:junit-platform-console-standalone", version = "1.11.4" } -kms = { module = "software.amazon.awssdk:kms", version = "2.15.28" } +kms = { module = "software.amazon.awssdk:kms", version.ref = "aws-sdk" } libphonenumber = { module = "com.googlecode.libphonenumber:libphonenumber", version = "8.12.50" } listenablefuture = { module = "com.google.guava:listenablefuture", version = "9999.0-empty-to-avoid-conflict-with-guava" } -log4j-1-2-api = { module = "org.apache.logging.log4j:log4j-1.2-api", version = "2.26.1" } -log4j-api = { module = "org.apache.logging.log4j:log4j-api", version = "2.26.1" } -log4j-core = { module = "org.apache.logging.log4j:log4j-core", version = "2.26.1" } +log4j-1-2-api = { module = "org.apache.logging.log4j:log4j-1.2-api", version.ref = "log4j" } +log4j-api = { module = "org.apache.logging.log4j:log4j-api", version.ref = "log4j" } +log4j-core = { module = "org.apache.logging.log4j:log4j-core", version.ref = "log4j" } management-api = { module = "org.glassfish.external:management-api", version = "3.2.1-b001" } -metrics-spi = { module = "software.amazon.awssdk:metrics-spi", version = "2.15.28" } -miglayout-core = { module = "com.miglayout:miglayout-core", version = "4.2" } -miglayout-swing = { module = "com.miglayout:miglayout-swing", version = "4.2" } +metrics-spi = { module = "software.amazon.awssdk:metrics-spi", version.ref = "aws-sdk" } +miglayout-core = { module = "com.miglayout:miglayout-core", version.ref = "miglayout" } +miglayout-swing = { module = "com.miglayout:miglayout-swing", version.ref = "miglayout" } mimepull = { module = "org.jvnet.mimepull:mimepull", version = "1.9.7" } -mockito-core = { module = "org.mockito:mockito-core", version = "5.1.1" } -mockito-inline = { module = "org.mockito:mockito-inline", version = "5.1.1" } +mockito-core = { module = "org.mockito:mockito-core", version.ref = "mockito" } +mockito-inline = { module = "org.mockito:mockito-inline", version.ref = "mockito" } mssql-jdbc = { module = "com.microsoft.sqlserver:mssql-jdbc", version = "10.2.4.jre11" } mybatis = { module = "org.mybatis:mybatis", version = "3.1.1" } mysql-connector-j = { module = "com.mysql:mysql-connector-j", version = "8.4.0" } -netty-buffer = { module = "io.netty:netty-buffer", version = "4.1.119.Final" } +netty-buffer = { module = "io.netty:netty-buffer", version.ref = "netty" } +# off the netty ref: bumped alone for a security fix; realign the family netty-codec = { module = "io.netty:netty-codec", version = "4.1.136.Final" } -netty-codec-http = { module = "io.netty:netty-codec-http", version = "4.1.119.Final" } -netty-codec-http2 = { module = "io.netty:netty-codec-http2", version = "4.1.119.Final" } -netty-common = { module = "io.netty:netty-common", version = "4.1.119.Final" } -netty-handler = { module = "io.netty:netty-handler", version = "4.1.119.Final" } +netty-codec-http = { module = "io.netty:netty-codec-http", version.ref = "netty" } +netty-codec-http2 = { module = "io.netty:netty-codec-http2", version.ref = "netty" } +netty-common = { module = "io.netty:netty-common", version.ref = "netty" } +netty-handler = { module = "io.netty:netty-handler", version.ref = "netty" } +# AWS SDK module, but not on the aws-sdk ref: the vendored jar was 2.20.140 netty-nio-client = { module = "software.amazon.awssdk:netty-nio-client", version = "2.20.140" } -netty-reactive-streams = { module = "com.typesafe.netty:netty-reactive-streams", version = "2.0.8" } -netty-reactive-streams-http = { module = "com.typesafe.netty:netty-reactive-streams-http", version = "2.0.8" } -netty-resolver = { module = "io.netty:netty-resolver", version = "4.1.119.Final" } -netty-transport = { module = "io.netty:netty-transport", version = "4.1.119.Final" } -netty-transport-native-unix-common = { module = "io.netty:netty-transport-native-unix-common", version = "4.1.119.Final" } +netty-reactive-streams = { module = "com.typesafe.netty:netty-reactive-streams", version.ref = "netty-reactive-streams" } +netty-reactive-streams-http = { module = "com.typesafe.netty:netty-reactive-streams-http", version.ref = "netty-reactive-streams" } +netty-resolver = { module = "io.netty:netty-resolver", version.ref = "netty" } +netty-transport = { module = "io.netty:netty-transport", version.ref = "netty" } +netty-transport-native-unix-common = { module = "io.netty:netty-transport-native-unix-common", version.ref = "netty" } objenesis = { module = "org.objenesis:objenesis", version = "2.5.1" } ojdbc8 = { module = "com.oracle.database.jdbc:ojdbc8", version = "12.2.0.1" } -openhtmltopdf-core = { module = "com.openhtmltopdf:openhtmltopdf-core", version = "1.0.9" } -openhtmltopdf-pdfbox = { module = "com.openhtmltopdf:openhtmltopdf-pdfbox", version = "1.0.9" } +openhtmltopdf-core = { module = "com.openhtmltopdf:openhtmltopdf-core", version.ref = "openhtmltopdf" } +openhtmltopdf-pdfbox = { module = "com.openhtmltopdf:openhtmltopdf-pdfbox", version.ref = "openhtmltopdf" } org-osgi-core = { module = "org.osgi:org.osgi.core", version = "4.2.0" } osgi-resource-locator = { module = "org.glassfish.hk2:osgi-resource-locator", version = "1.0.1" } oshi-core = { module = "com.github.oshi:oshi-core", version = "3.9.1" } -pdfbox = { module = "org.apache.pdfbox:pdfbox", version = "2.0.24" } +pdfbox = { module = "org.apache.pdfbox:pdfbox", version.ref = "pdfbox" } persistence-api = { module = "javax.persistence:persistence-api", version = "1.0" } policy = { module = "com.sun.xml.ws:policy", version = "2.7.2" } -profiles = { module = "software.amazon.awssdk:profiles", version = "2.15.28" } -protocol-core = { module = "software.amazon.awssdk:protocol-core", version = "2.15.28" } +profiles = { module = "software.amazon.awssdk:profiles", version.ref = "aws-sdk" } +protocol-core = { module = "software.amazon.awssdk:protocol-core", version.ref = "aws-sdk" } quartz = { module = "org.quartz-scheduler:quartz", version = "2.3.2" } reactive-streams = { module = "org.reactivestreams:reactive-streams", version = "1.0.3" } reflections = { module = "org.reflections:reflections", version = "0.9.10" } -regions = { module = "software.amazon.awssdk:regions", version = "2.15.28" } +regions = { module = "software.amazon.awssdk:regions", version.ref = "aws-sdk" } rhino = { module = "org.mozilla:rhino", version = "1.7.13" } -s3 = { module = "software.amazon.awssdk:s3", version = "2.15.28" } +s3 = { module = "software.amazon.awssdk:s3", version.ref = "aws-sdk" } saaj-impl = { module = "com.sun.xml.messaging.saaj:saaj-impl", version = "1.4.0" } -sdk-core = { module = "software.amazon.awssdk:sdk-core", version = "2.15.28" } -slf4j-api = { module = "org.slf4j:slf4j-api", version = "1.7.30" } -slf4j-log4j12 = { module = "org.slf4j:slf4j-log4j12", version = "1.7.30" } +sdk-core = { module = "software.amazon.awssdk:sdk-core", version.ref = "aws-sdk" } +slf4j-api = { module = "org.slf4j:slf4j-api", version.ref = "slf4j" } +slf4j-log4j12 = { module = "org.slf4j:slf4j-log4j12", version.ref = "slf4j" } stax-ex = { module = "org.jvnet.staxex:stax-ex", version = "1.8" } staxon = { module = "de.odysseus.staxon:staxon", version = "1.3" } streambuffer = { module = "com.sun.xml.stream.buffer:streambuffer", version = "1.5.4" } -sts = { module = "software.amazon.awssdk:sts", version = "2.15.28" } -swagger-annotations = { module = "io.swagger.core.v3:swagger-annotations", version = "2.0.10" } -swagger-core = { module = "io.swagger.core.v3:swagger-core", version = "2.0.10" } -swagger-integration = { module = "io.swagger.core.v3:swagger-integration", version = "2.0.10" } -swagger-jaxrs2 = { module = "io.swagger.core.v3:swagger-jaxrs2", version = "2.0.10" } -swagger-jaxrs2-servlet-initializer = { module = "io.swagger.core.v3:swagger-jaxrs2-servlet-initializer", version = "2.0.10" } -swagger-models = { module = "io.swagger.core.v3:swagger-models", version = "2.0.10" } +sts = { module = "software.amazon.awssdk:sts", version.ref = "aws-sdk" } +swagger-annotations = { module = "io.swagger.core.v3:swagger-annotations", version.ref = "swagger" } +swagger-core = { module = "io.swagger.core.v3:swagger-core", version.ref = "swagger" } +swagger-integration = { module = "io.swagger.core.v3:swagger-integration", version.ref = "swagger" } +swagger-jaxrs2 = { module = "io.swagger.core.v3:swagger-jaxrs2", version.ref = "swagger" } +swagger-jaxrs2-servlet-initializer = { module = "io.swagger.core.v3:swagger-jaxrs2-servlet-initializer", version.ref = "swagger" } +swagger-models = { module = "io.swagger.core.v3:swagger-models", version.ref = "swagger" } # 1.6.2-2 is the re-release of 1.6.2 with a fixed POM (1.6.2's parent POM # references an unpublished SNAPSHOT and cannot be resolved); jar bytes identical swingx-core = { module = "org.swinglabs:swingx-core", version = "1.6.2-2" } -taglibs-standard-impl = { module = "org.apache.taglibs:taglibs-standard-impl", version = "1.2.5" } -taglibs-standard-spec = { module = "org.apache.taglibs:taglibs-standard-spec", version = "1.2.5" } -txw2 = { module = "org.glassfish.jaxb:txw2", version = "2.4.0-b180725.0644" } -utils = { module = "software.amazon.awssdk:utils", version = "2.15.28" } +taglibs-standard-impl = { module = "org.apache.taglibs:taglibs-standard-impl", version.ref = "taglibs" } +taglibs-standard-spec = { module = "org.apache.taglibs:taglibs-standard-spec", version.ref = "taglibs" } +txw2 = { module = "org.glassfish.jaxb:txw2", version.ref = "jaxb-ri" } +utils = { module = "software.amazon.awssdk:utils", version.ref = "aws-sdk" } validation-api = { module = "javax.validation:validation-api", version = "1.1.0.Final" } velocity-engine-core = { module = "org.apache.velocity:velocity-engine-core", version = "2.3" } velocity-tools-generic = { module = "org.apache.velocity.tools:velocity-tools-generic", version = "3.1" } -xmpbox = { module = "org.apache.pdfbox:xmpbox", version = "2.0.24" } +xmpbox = { module = "org.apache.pdfbox:xmpbox", version.ref = "pdfbox" } xpp3 = { module = "xpp3:xpp3", version = "1.1.4c" } xstream = { module = "com.thoughtworks.xstream:xstream", version = "1.4.20" } jsch = { module = "com.github.mwiede:jsch", version = "2.27.7" } From d1deda87fc91b13522d004d1d4344b7391b44056 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Wed, 30 Sep 2026 01:25:06 -0400 Subject: [PATCH 2/6] Give version catalog aliases unambiguous names Aliases were bare artifactIds, so accessors like libs.utils, libs.auth, libs.annotations and libs.policy did not say which project they came from, netty-nio-client read as part of the io.netty family, and apache-jsp-v8-5-70 implied a second version of apache-jsp when it is a different artifact (org.mortbay.jasper). - Prefix AWS SDK modules with awssdk- (and rename the version ref to match); prefix the Jasper, hk2-external, GlassFish, JAX-WS and pdfbox-graphics2d entries with their project. - Sort [libraries] and each bundle alphabetically, and write bundles one entry per line so dependency changes diff and merge cleanly. Only the catalog changes; build scripts reference bundles, which keep their names. Every alias and bundle expands to the same module:version set as before. Bundle order sets classpath order, so the order changed; the only resource whose providing jar changed is the Eclipse about.html shared by jetty apache-jsp and ecj. Signed-off-by: Tony Germano --- gradle/libs.versions.toml | 466 ++++++++++++++++++++++++++++++++++---- 1 file changed, 420 insertions(+), 46 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index f956041dc..bada6f592 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -5,7 +5,7 @@ [versions] # Shared by artifacts released together; bump the whole family at once. asm = "9.6" -aws-sdk = "2.15.28" +awssdk = "2.15.28" bouncycastle = "1.78.1" byte-buddy = "1.14.13" flying-saucer = "9.0.1" @@ -33,22 +33,31 @@ swagger = "2.0.10" taglibs = "1.2.5" [libraries] -annotations = { module = "software.amazon.awssdk:annotations", version.ref = "aws-sdk" } -aopalliance-repackaged = { module = "org.glassfish.hk2.external:aopalliance-repackaged", version.ref = "hk2" } -apache-client = { module = "software.amazon.awssdk:apache-client", version.ref = "aws-sdk" } -apache-el = { module = "org.mortbay.jasper:apache-el", version.ref = "jasper" } -apache-jsp = { module = "org.eclipse.jetty:apache-jsp", version.ref = "jetty" } -apache-jsp-v8-5-70 = { module = "org.mortbay.jasper:apache-jsp", version.ref = "jasper" } asm = { module = "org.ow2.asm:asm", version.ref = "asm" } asm-analysis = { module = "org.ow2.asm:asm-analysis", version.ref = "asm" } asm-commons = { module = "org.ow2.asm:asm-commons", version.ref = "asm" } asm-tree = { module = "org.ow2.asm:asm-tree", version.ref = "asm" } asm-util = { module = "org.ow2.asm:asm-util", version.ref = "asm" } -auth = { module = "software.amazon.awssdk:auth", version.ref = "aws-sdk" } -aws-core = { module = "software.amazon.awssdk:aws-core", version.ref = "aws-sdk" } -aws-json-protocol = { module = "software.amazon.awssdk:aws-json-protocol", version.ref = "aws-sdk" } -aws-query-protocol = { module = "software.amazon.awssdk:aws-query-protocol", version.ref = "aws-sdk" } -aws-xml-protocol = { module = "software.amazon.awssdk:aws-xml-protocol", version.ref = "aws-sdk" } +aws-eventstream = { module = "software.amazon.eventstream:eventstream", version = "1.0.1" } +awssdk-annotations = { module = "software.amazon.awssdk:annotations", version.ref = "awssdk" } +awssdk-apache-client = { module = "software.amazon.awssdk:apache-client", version.ref = "awssdk" } +awssdk-auth = { module = "software.amazon.awssdk:auth", version.ref = "awssdk" } +awssdk-aws-core = { module = "software.amazon.awssdk:aws-core", version.ref = "awssdk" } +awssdk-aws-json-protocol = { module = "software.amazon.awssdk:aws-json-protocol", version.ref = "awssdk" } +awssdk-aws-query-protocol = { module = "software.amazon.awssdk:aws-query-protocol", version.ref = "awssdk" } +awssdk-aws-xml-protocol = { module = "software.amazon.awssdk:aws-xml-protocol", version.ref = "awssdk" } +awssdk-http-client-spi = { module = "software.amazon.awssdk:http-client-spi", version.ref = "awssdk" } +awssdk-kms = { module = "software.amazon.awssdk:kms", version.ref = "awssdk" } +awssdk-metrics-spi = { module = "software.amazon.awssdk:metrics-spi", version.ref = "awssdk" } +# AWS SDK module, but not on the awssdk ref: the vendored jar was 2.20.140 +awssdk-netty-nio-client = { module = "software.amazon.awssdk:netty-nio-client", version = "2.20.140" } +awssdk-profiles = { module = "software.amazon.awssdk:profiles", version.ref = "awssdk" } +awssdk-protocol-core = { module = "software.amazon.awssdk:protocol-core", version.ref = "awssdk" } +awssdk-regions = { module = "software.amazon.awssdk:regions", version.ref = "awssdk" } +awssdk-s3 = { module = "software.amazon.awssdk:s3", version.ref = "awssdk" } +awssdk-sdk-core = { module = "software.amazon.awssdk:sdk-core", version.ref = "awssdk" } +awssdk-sts = { module = "software.amazon.awssdk:sts", version.ref = "awssdk" } +awssdk-utils = { module = "software.amazon.awssdk:utils", version.ref = "awssdk" } bcpkix-jdk18on = { module = "org.bouncycastle:bcpkix-jdk18on", version.ref = "bouncycastle" } bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "bouncycastle" } bcutil-jdk18on = { module = "org.bouncycastle:bcutil-jdk18on", version.ref = "bouncycastle" } @@ -84,7 +93,6 @@ derby = { module = "org.apache.derby:derby", version = "10.11.1.1" } derbytools = { module = "org.apache.derby:derbytools", version = "10.10.2.0" } ecj = { module = "org.eclipse.jdt:ecj", version = "3.19.0" } error-prone-annotations = { module = "com.google.errorprone:error_prone_annotations", version = "2.3.4" } -eventstream = { module = "software.amazon.eventstream:eventstream", version = "1.0.1" } failureaccess = { module = "com.google.guava:failureaccess", version = "1.0.1" } fastinfoset = { module = "com.sun.xml.fastinfoset:FastInfoset", version = "1.2.13" } flying-saucer-core = { module = "org.xhtmlrenderer:flying-saucer-core", version.ref = "flying-saucer" } @@ -92,20 +100,21 @@ flying-saucer-pdf = { module = "org.xhtmlrenderer:flying-saucer-pdf", version.re fontbox = { module = "org.apache.pdfbox:fontbox", version.ref = "pdfbox" } geronimo-j2ee-management-1-1-spec = { module = "org.apache.geronimo.specs:geronimo-j2ee-management_1.1_spec", version = "1.0.1" } geronimo-jms-1-1-spec = { module = "org.apache.geronimo.specs:geronimo-jms_1.1_spec", version = "1.1.1" } +glassfish-ha-api = { module = "org.glassfish.ha:ha-api", version = "3.1.9" } +glassfish-management-api = { module = "org.glassfish.external:management-api", version = "3.2.1-b001" } gmbal-api-only = { module = "org.glassfish.gmbal:gmbal-api-only", version = "3.1.0-b001" } -graphics2d = { module = "de.rototor.pdfbox:graphics2d", version = "0.32" } guava = { module = "com.google.guava:guava", version = "32.0.1-jre" } guice = { module = "com.google.inject:guice", version = "4.1.0" } -ha-api = { module = "org.glassfish.ha:ha-api", version = "3.1.9" } hamcrest = { module = "org.hamcrest:hamcrest", version = "2.2" } hapi-structures-v27 = { module = "ca.uhn.hapi:hapi-structures-v27", version.ref = "hapi" } hapi-structures-v28 = { module = "ca.uhn.hapi:hapi-structures-v28", version.ref = "hapi" } hapi-structures-v281 = { module = "ca.uhn.hapi:hapi-structures-v281", version.ref = "hapi" } hikaricp = { module = "com.zaxxer:HikariCP", version = "2.5.1" } +hk2-aopalliance-repackaged = { module = "org.glassfish.hk2.external:aopalliance-repackaged", version.ref = "hk2" } hk2-api = { module = "org.glassfish.hk2:hk2-api", version.ref = "hk2" } +hk2-javax-inject = { module = "org.glassfish.hk2.external:javax.inject", version.ref = "hk2" } hk2-locator = { module = "org.glassfish.hk2:hk2-locator", version.ref = "hk2" } hk2-utils = { module = "org.glassfish.hk2:hk2-utils", version.ref = "hk2" } -http-client-spi = { module = "software.amazon.awssdk:http-client-spi", version.ref = "aws-sdk" } httpclient = { module = "org.apache.httpcomponents:httpclient", version.ref = "httpclient" } httpcore = { module = "org.apache.httpcomponents:httpcore", version = "4.4.13" } httpmime = { module = "org.apache.httpcomponents:httpmime", version.ref = "httpclient" } @@ -128,20 +137,24 @@ jackson-dataformat-yaml = { module = "com.fasterxml.jackson.dataformat:jackson-d jackson-datatype-jsr310 = { module = "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", version.ref = "jackson" } jakarta-activation = { module = "com.sun.activation:jakarta.activation", version = "1.2.1" } jakarta-mail = { module = "com.sun.mail:jakarta.mail", version = "1.6.8" } +jasper-apache-el = { module = "org.mortbay.jasper:apache-el", version.ref = "jasper" } +jasper-apache-jsp = { module = "org.mortbay.jasper:apache-jsp", version.ref = "jasper" } java-semver = { module = "com.github.zafarkhaja:java-semver", version = "0.10.2" } javassist = { module = "org.javassist:javassist", version = "3.26.0-GA" } javax-activation-api = { module = "javax.activation:javax.activation-api", version = "1.2.0" } javax-annotation-api = { module = "javax.annotation:javax.annotation-api", version = "1.3.2" } javax-annotation-api-v1-3 = { module = "javax.annotation:javax.annotation-api", version = "1.3" } -javax-inject = { module = "org.glassfish.hk2.external:javax.inject", version.ref = "hk2" } javax-json = { module = "org.glassfish:javax.json", version = "1.0.4" } javax-json-api = { module = "javax.json:javax.json-api", version = "1.0" } +javax-persistence-api = { module = "javax.persistence:persistence-api", version = "1.0" } javax-servlet-api = { module = "javax.servlet:javax.servlet-api", version = "3.1.0" } +javax-validation-api = { module = "javax.validation:validation-api", version = "1.1.0.Final" } javax-ws-rs-api = { module = "javax.ws.rs:javax.ws.rs-api", version = "2.0.1" } javax-xml-soap-api = { module = "javax.xml.soap:javax.xml.soap-api", version = "1.4.0" } jaxb-api = { module = "javax.xml.bind:jaxb-api", version = "2.4.0-b180725.0427" } jaxb-runtime = { module = "org.glassfish.jaxb:jaxb-runtime", version.ref = "jaxb-ri" } jaxws-api = { module = "javax.xml.ws:jaxws-api", version = "2.3.0" } +jaxws-policy = { module = "com.sun.xml.ws:policy", version = "2.7.2" } jaxws-rt = { module = "com.sun.xml.ws:jaxws-rt", version.ref = "jaxws-ri" } jaxws-tools = { module = "com.sun.xml.ws:jaxws-tools", version.ref = "jaxws-ri" } jcifs-ng = { module = "eu.agno3.jcifs:jcifs-ng", version = "2.1.10" } @@ -158,6 +171,7 @@ jersey-media-multipart = { module = "org.glassfish.jersey.media:jersey-media-mul jersey-proxy-client = { module = "org.glassfish.jersey.ext:jersey-proxy-client", version.ref = "jersey" } jersey-server = { module = "org.glassfish.jersey.core:jersey-server", version.ref = "jersey" } jetty-annotations = { module = "org.eclipse.jetty:jetty-annotations", version.ref = "jetty" } +jetty-apache-jsp = { module = "org.eclipse.jetty:apache-jsp", version.ref = "jetty" } jetty-continuation = { module = "org.eclipse.jetty:jetty-continuation", version.ref = "jetty" } jetty-http = { module = "org.eclipse.jetty:jetty-http", version.ref = "jetty" } jetty-io = { module = "org.eclipse.jetty:jetty-io", version.ref = "jetty" } @@ -175,19 +189,17 @@ jetty-xml = { module = "org.eclipse.jetty:jetty-xml", version.ref = "jetty" } jna = { module = "net.java.dev.jna:jna", version.ref = "jna" } jna-platform = { module = "net.java.dev.jna:jna-platform", version.ref = "jna" } joda-time = { module = "joda-time:joda-time", version = "2.9.9" } +jsch = { module = "com.github.mwiede:jsch", version = "2.27.7" } jsr181-api = { module = "javax.jws:jsr181-api", version = "1.0-MR1" } jsr305 = { module = "com.google.code.findbugs:jsr305", version = "3.0.2" } junit = { module = "junit:junit", version = "4.8.1" } -junit-v4-13-1 = { module = "junit:junit", version = "4.13.1" } junit-platform-console-standalone = { module = "org.junit.platform:junit-platform-console-standalone", version = "1.11.4" } -kms = { module = "software.amazon.awssdk:kms", version.ref = "aws-sdk" } +junit-v4-13-1 = { module = "junit:junit", version = "4.13.1" } libphonenumber = { module = "com.googlecode.libphonenumber:libphonenumber", version = "8.12.50" } listenablefuture = { module = "com.google.guava:listenablefuture", version = "9999.0-empty-to-avoid-conflict-with-guava" } log4j-1-2-api = { module = "org.apache.logging.log4j:log4j-1.2-api", version.ref = "log4j" } log4j-api = { module = "org.apache.logging.log4j:log4j-api", version.ref = "log4j" } log4j-core = { module = "org.apache.logging.log4j:log4j-core", version.ref = "log4j" } -management-api = { module = "org.glassfish.external:management-api", version = "3.2.1-b001" } -metrics-spi = { module = "software.amazon.awssdk:metrics-spi", version.ref = "aws-sdk" } miglayout-core = { module = "com.miglayout:miglayout-core", version.ref = "miglayout" } miglayout-swing = { module = "com.miglayout:miglayout-swing", version.ref = "miglayout" } mimepull = { module = "org.jvnet.mimepull:mimepull", version = "1.9.7" } @@ -203,8 +215,6 @@ netty-codec-http = { module = "io.netty:netty-codec-http", version.ref = "netty" netty-codec-http2 = { module = "io.netty:netty-codec-http2", version.ref = "netty" } netty-common = { module = "io.netty:netty-common", version.ref = "netty" } netty-handler = { module = "io.netty:netty-handler", version.ref = "netty" } -# AWS SDK module, but not on the aws-sdk ref: the vendored jar was 2.20.140 -netty-nio-client = { module = "software.amazon.awssdk:netty-nio-client", version = "2.20.140" } netty-reactive-streams = { module = "com.typesafe.netty:netty-reactive-streams", version.ref = "netty-reactive-streams" } netty-reactive-streams-http = { module = "com.typesafe.netty:netty-reactive-streams-http", version.ref = "netty-reactive-streams" } netty-resolver = { module = "io.netty:netty-resolver", version.ref = "netty" } @@ -214,28 +224,23 @@ objenesis = { module = "org.objenesis:objenesis", version = "2.5.1" } ojdbc8 = { module = "com.oracle.database.jdbc:ojdbc8", version = "12.2.0.1" } openhtmltopdf-core = { module = "com.openhtmltopdf:openhtmltopdf-core", version.ref = "openhtmltopdf" } openhtmltopdf-pdfbox = { module = "com.openhtmltopdf:openhtmltopdf-pdfbox", version.ref = "openhtmltopdf" } -org-osgi-core = { module = "org.osgi:org.osgi.core", version = "4.2.0" } +osgi-core = { module = "org.osgi:org.osgi.core", version = "4.2.0" } osgi-resource-locator = { module = "org.glassfish.hk2:osgi-resource-locator", version = "1.0.1" } oshi-core = { module = "com.github.oshi:oshi-core", version = "3.9.1" } pdfbox = { module = "org.apache.pdfbox:pdfbox", version.ref = "pdfbox" } -persistence-api = { module = "javax.persistence:persistence-api", version = "1.0" } -policy = { module = "com.sun.xml.ws:policy", version = "2.7.2" } -profiles = { module = "software.amazon.awssdk:profiles", version.ref = "aws-sdk" } -protocol-core = { module = "software.amazon.awssdk:protocol-core", version.ref = "aws-sdk" } +pdfbox-graphics2d = { module = "de.rototor.pdfbox:graphics2d", version = "0.32" } +postgresql = { module = "org.postgresql:postgresql", version = "42.7.12" } quartz = { module = "org.quartz-scheduler:quartz", version = "2.3.2" } reactive-streams = { module = "org.reactivestreams:reactive-streams", version = "1.0.3" } reflections = { module = "org.reflections:reflections", version = "0.9.10" } -regions = { module = "software.amazon.awssdk:regions", version.ref = "aws-sdk" } rhino = { module = "org.mozilla:rhino", version = "1.7.13" } -s3 = { module = "software.amazon.awssdk:s3", version.ref = "aws-sdk" } saaj-impl = { module = "com.sun.xml.messaging.saaj:saaj-impl", version = "1.4.0" } -sdk-core = { module = "software.amazon.awssdk:sdk-core", version.ref = "aws-sdk" } slf4j-api = { module = "org.slf4j:slf4j-api", version.ref = "slf4j" } slf4j-log4j12 = { module = "org.slf4j:slf4j-log4j12", version.ref = "slf4j" } +snakeyaml = { module = "org.yaml:snakeyaml", version = "2.5" } stax-ex = { module = "org.jvnet.staxex:stax-ex", version = "1.8" } staxon = { module = "de.odysseus.staxon:staxon", version = "1.3" } streambuffer = { module = "com.sun.xml.stream.buffer:streambuffer", version = "1.5.4" } -sts = { module = "software.amazon.awssdk:sts", version.ref = "aws-sdk" } swagger-annotations = { module = "io.swagger.core.v3:swagger-annotations", version.ref = "swagger" } swagger-core = { module = "io.swagger.core.v3:swagger-core", version.ref = "swagger" } swagger-integration = { module = "io.swagger.core.v3:swagger-integration", version.ref = "swagger" } @@ -248,24 +253,393 @@ swingx-core = { module = "org.swinglabs:swingx-core", version = "1.6.2-2" } taglibs-standard-impl = { module = "org.apache.taglibs:taglibs-standard-impl", version.ref = "taglibs" } taglibs-standard-spec = { module = "org.apache.taglibs:taglibs-standard-spec", version.ref = "taglibs" } txw2 = { module = "org.glassfish.jaxb:txw2", version.ref = "jaxb-ri" } -utils = { module = "software.amazon.awssdk:utils", version.ref = "aws-sdk" } -validation-api = { module = "javax.validation:validation-api", version = "1.1.0.Final" } velocity-engine-core = { module = "org.apache.velocity:velocity-engine-core", version = "2.3" } velocity-tools-generic = { module = "org.apache.velocity.tools:velocity-tools-generic", version = "3.1" } xmpbox = { module = "org.apache.pdfbox:xmpbox", version.ref = "pdfbox" } xpp3 = { module = "xpp3:xpp3", version = "1.1.4c" } xstream = { module = "com.thoughtworks.xstream:xstream", version = "1.4.20" } -jsch = { module = "com.github.mwiede:jsch", version = "2.27.7" } -postgresql = { module = "org.postgresql:postgresql", version = "42.7.12" } -snakeyaml = { module = "org.yaml:snakeyaml", version = "2.5" } [bundles] -client-main = ["bcpkix-jdk18on", "bcprov-jdk18on", "bcutil-jdk18on", "commons-beanutils", "commons-codec", "commons-collections4", "commons-compress", "commons-configuration2", "commons-io", "commons-lang3", "commons-logging", "commons-pool2", "commons-text", "commons-vfs2", "guava", "hapi-structures-v27", "hapi-structures-v28", "hapi-structures-v281", "hk2-api", "hk2-locator", "hk2-utils", "httpclient", "httpcore", "httpmime", "jackson-annotations", "jackson-core", "jackson-databind", "jakarta-activation", "jakarta-mail", "java-semver", "javassist", "javax-activation-api", "javax-annotation-api", "javax-inject", "javax-ws-rs-api", "jaxb-api", "jaxb-runtime", "jcifs-ng", "jersey-client", "jersey-common", "jersey-guava", "jersey-media-multipart", "jersey-proxy-client", "jetty-util", "joda-time", "libphonenumber", "log4j-1-2-api", "log4j-api", "log4j-core", "miglayout-core", "miglayout-swing", "mimepull", "quartz", "reflections", "regions", "rhino", "slf4j-api", "slf4j-log4j12", "staxon", "swagger-annotations", "swingx-core", "utils", "velocity-engine-core", "velocity-tools-generic", "xpp3", "xstream"] -command-main = ["bcpkix-jdk18on", "bcprov-jdk18on", "bcutil-jdk18on", "commons-beanutils", "commons-cli", "commons-codec", "commons-collections4", "commons-configuration2", "commons-io", "commons-lang3", "commons-logging", "commons-pool2", "commons-text", "commons-vfs2", "guava", "hk2-api", "hk2-locator", "hk2-utils", "httpclient", "httpcore", "httpmime", "jackson-annotations", "jackson-core", "jackson-databind", "jakarta-activation", "javassist", "javax-activation-api", "javax-annotation-api-v1-3", "javax-inject", "javax-ws-rs-api", "jaxb-api", "jaxb-runtime", "jersey-client", "jersey-common", "jersey-guava", "jersey-media-multipart", "jersey-proxy-client", "jetty-util", "log4j-api", "log4j-core", "mimepull", "reflections", "rhino", "slf4j-api", "slf4j-log4j12", "staxon", "swagger-annotations", "velocity-engine-core", "velocity-tools-generic", "xpp3", "xstream"] -command-test = ["junit"] -donkey-main = ["checker-qual", "commons-beanutils", "commons-codec", "commons-collections4", "commons-dbcp2", "commons-dbutils", "commons-io", "commons-lang3", "commons-logging", "commons-math3", "commons-pool2", "commons-text", "derby", "error-prone-annotations", "failureaccess", "guava", "guice", "hikaricp", "j2objc-annotations", "javassist", "jsr305", "listenablefuture", "log4j-1-2-api", "log4j-api", "log4j-core", "mssql-jdbc", "mysql-connector-j", "ojdbc8", "postgresql", "quartz", "slf4j-api", "slf4j-log4j12", "xpp3", "xstream"] -donkey-test = ["aopalliance-repackaged", "byte-buddy", "byte-buddy-agent", "javax-inject", "junit", "mockito-core", "objenesis"] -generator-main = ["commons-collections4", "commons-io", "commons-lang3", "log4j-1-2-api", "log4j-api", "log4j-core", "slf4j-api", "slf4j-log4j12", "velocity-engine-core"] -server-main = ["annotations", "aopalliance-repackaged", "apache-client", "apache-el", "apache-jsp", "apache-jsp-v8-5-70", "asm", "asm-analysis", "asm-commons", "asm-tree", "asm-util", "auth", "aws-core", "aws-json-protocol", "aws-query-protocol", "aws-xml-protocol", "bcpkix-jdk18on", "bcprov-jdk18on", "bcutil-jdk18on", "classgraph", "commons-beanutils", "commons-cli", "commons-codec", "commons-collections", "commons-collections4", "commons-compress", "commons-configuration2", "commons-dbcp2", "commons-dbutils", "commons-digester3", "commons-el", "commons-email", "commons-fileupload", "commons-httpclient", "commons-io", "commons-jxpath", "commons-lang3", "commons-logging", "commons-math3", "commons-net", "commons-pool2", "commons-text", "commons-vfs2", "derby", "derbytools", "ecj", "eventstream", "fastinfoset", "geronimo-j2ee-management-1-1-spec", "geronimo-jms-1-1-spec", "gmbal-api-only", "guice", "ha-api", "hapi-structures-v27", "hapi-structures-v28", "hapi-structures-v281", "hikaricp", "hk2-api", "hk2-locator", "hk2-utils", "http-client-spi", "httpclient", "httpcore", "httpmime", "jackson-annotations", "jackson-core", "jackson-databind", "jackson-dataformat-cbor", "jackson-dataformat-yaml", "jackson-datatype-jsr310", "jakarta-activation", "jakarta-mail", "java-semver", "javassist", "javax-activation-api", "javax-annotation-api", "javax-inject", "javax-json", "javax-json-api", "javax-servlet-api", "javax-ws-rs-api", "javax-xml-soap-api", "jaxb-api", "jaxb-runtime", "jaxws-api", "jaxws-rt", "jaxws-tools", "jdom2", "jersey-client", "jersey-common", "jersey-container-jetty-http", "jersey-container-jetty-servlet", "jersey-container-servlet", "jersey-container-servlet-core", "jersey-guava", "jersey-media-jaxb", "jersey-media-multipart", "jersey-proxy-client", "jersey-server", "jetty-annotations", "jetty-continuation", "jetty-http", "jetty-io", "jetty-jndi", "jetty-plus", "jetty-rewrite", "jetty-schemas", "jetty-security", "jetty-server", "jetty-servlet", "jetty-util", "jetty-util-ajax", "jetty-webapp", "jetty-xml", "jna", "jna-platform", "joda-time", "jsch", "jsr181-api", "kms", "log4j-1-2-api", "log4j-api", "log4j-core", "management-api", "metrics-spi", "mimepull", "mssql-jdbc", "mybatis", "mysql-connector-j", "netty-buffer", "netty-codec", "netty-codec-http", "netty-codec-http2", "netty-common", "netty-handler", "netty-nio-client", "netty-reactive-streams", "netty-reactive-streams-http", "netty-resolver", "netty-transport", "netty-transport-native-unix-common", "ojdbc8", "org-osgi-core", "osgi-resource-locator", "oshi-core", "persistence-api", "policy", "postgresql", "profiles", "protocol-core", "quartz", "reactive-streams", "reflections", "regions", "rhino", "s3", "saaj-impl", "sdk-core", "snakeyaml", "stax-ex", "staxon", "streambuffer", "sts", "swagger-annotations", "swagger-core", "swagger-integration", "swagger-jaxrs2", "swagger-jaxrs2-servlet-initializer", "swagger-models", "taglibs-standard-impl", "taglibs-standard-spec", "txw2", "utils", "validation-api", "velocity-engine-core", "velocity-tools-generic", "xpp3", "xstream"] -server-test = ["byte-buddy", "byte-buddy-agent", "hamcrest", "junit-v4-13-1", "mockito-core", "mockito-inline", "objenesis"] -server-extensions = ["flying-saucer-core", "flying-saucer-pdf", "fontbox", "graphics2d", "imagej", "itext", "itext-rtf", "jcifs-ng", "openhtmltopdf-core", "openhtmltopdf-pdfbox", "pdfbox", "xmpbox"] +client-main = [ + "awssdk-regions", + "awssdk-utils", + "bcpkix-jdk18on", + "bcprov-jdk18on", + "bcutil-jdk18on", + "commons-beanutils", + "commons-codec", + "commons-collections4", + "commons-compress", + "commons-configuration2", + "commons-io", + "commons-lang3", + "commons-logging", + "commons-pool2", + "commons-text", + "commons-vfs2", + "guava", + "hapi-structures-v27", + "hapi-structures-v28", + "hapi-structures-v281", + "hk2-api", + "hk2-javax-inject", + "hk2-locator", + "hk2-utils", + "httpclient", + "httpcore", + "httpmime", + "jackson-annotations", + "jackson-core", + "jackson-databind", + "jakarta-activation", + "jakarta-mail", + "java-semver", + "javassist", + "javax-activation-api", + "javax-annotation-api", + "javax-ws-rs-api", + "jaxb-api", + "jaxb-runtime", + "jcifs-ng", + "jersey-client", + "jersey-common", + "jersey-guava", + "jersey-media-multipart", + "jersey-proxy-client", + "jetty-util", + "joda-time", + "libphonenumber", + "log4j-1-2-api", + "log4j-api", + "log4j-core", + "miglayout-core", + "miglayout-swing", + "mimepull", + "quartz", + "reflections", + "rhino", + "slf4j-api", + "slf4j-log4j12", + "staxon", + "swagger-annotations", + "swingx-core", + "velocity-engine-core", + "velocity-tools-generic", + "xpp3", + "xstream", +] +command-main = [ + "bcpkix-jdk18on", + "bcprov-jdk18on", + "bcutil-jdk18on", + "commons-beanutils", + "commons-cli", + "commons-codec", + "commons-collections4", + "commons-configuration2", + "commons-io", + "commons-lang3", + "commons-logging", + "commons-pool2", + "commons-text", + "commons-vfs2", + "guava", + "hk2-api", + "hk2-javax-inject", + "hk2-locator", + "hk2-utils", + "httpclient", + "httpcore", + "httpmime", + "jackson-annotations", + "jackson-core", + "jackson-databind", + "jakarta-activation", + "javassist", + "javax-activation-api", + "javax-annotation-api-v1-3", + "javax-ws-rs-api", + "jaxb-api", + "jaxb-runtime", + "jersey-client", + "jersey-common", + "jersey-guava", + "jersey-media-multipart", + "jersey-proxy-client", + "jetty-util", + "log4j-api", + "log4j-core", + "mimepull", + "reflections", + "rhino", + "slf4j-api", + "slf4j-log4j12", + "staxon", + "swagger-annotations", + "velocity-engine-core", + "velocity-tools-generic", + "xpp3", + "xstream", +] +command-test = [ + "junit", +] +donkey-main = [ + "checker-qual", + "commons-beanutils", + "commons-codec", + "commons-collections4", + "commons-dbcp2", + "commons-dbutils", + "commons-io", + "commons-lang3", + "commons-logging", + "commons-math3", + "commons-pool2", + "commons-text", + "derby", + "error-prone-annotations", + "failureaccess", + "guava", + "guice", + "hikaricp", + "j2objc-annotations", + "javassist", + "jsr305", + "listenablefuture", + "log4j-1-2-api", + "log4j-api", + "log4j-core", + "mssql-jdbc", + "mysql-connector-j", + "ojdbc8", + "postgresql", + "quartz", + "slf4j-api", + "slf4j-log4j12", + "xpp3", + "xstream", +] +donkey-test = [ + "byte-buddy", + "byte-buddy-agent", + "hk2-aopalliance-repackaged", + "hk2-javax-inject", + "junit", + "mockito-core", + "objenesis", +] +generator-main = [ + "commons-collections4", + "commons-io", + "commons-lang3", + "log4j-1-2-api", + "log4j-api", + "log4j-core", + "slf4j-api", + "slf4j-log4j12", + "velocity-engine-core", +] +server-extensions = [ + "flying-saucer-core", + "flying-saucer-pdf", + "fontbox", + "imagej", + "itext", + "itext-rtf", + "jcifs-ng", + "openhtmltopdf-core", + "openhtmltopdf-pdfbox", + "pdfbox", + "pdfbox-graphics2d", + "xmpbox", +] +server-main = [ + "asm", + "asm-analysis", + "asm-commons", + "asm-tree", + "asm-util", + "aws-eventstream", + "awssdk-annotations", + "awssdk-apache-client", + "awssdk-auth", + "awssdk-aws-core", + "awssdk-aws-json-protocol", + "awssdk-aws-query-protocol", + "awssdk-aws-xml-protocol", + "awssdk-http-client-spi", + "awssdk-kms", + "awssdk-metrics-spi", + "awssdk-netty-nio-client", + "awssdk-profiles", + "awssdk-protocol-core", + "awssdk-regions", + "awssdk-s3", + "awssdk-sdk-core", + "awssdk-sts", + "awssdk-utils", + "bcpkix-jdk18on", + "bcprov-jdk18on", + "bcutil-jdk18on", + "classgraph", + "commons-beanutils", + "commons-cli", + "commons-codec", + "commons-collections", + "commons-collections4", + "commons-compress", + "commons-configuration2", + "commons-dbcp2", + "commons-dbutils", + "commons-digester3", + "commons-el", + "commons-email", + "commons-fileupload", + "commons-httpclient", + "commons-io", + "commons-jxpath", + "commons-lang3", + "commons-logging", + "commons-math3", + "commons-net", + "commons-pool2", + "commons-text", + "commons-vfs2", + "derby", + "derbytools", + "ecj", + "fastinfoset", + "geronimo-j2ee-management-1-1-spec", + "geronimo-jms-1-1-spec", + "glassfish-ha-api", + "glassfish-management-api", + "gmbal-api-only", + "guice", + "hapi-structures-v27", + "hapi-structures-v28", + "hapi-structures-v281", + "hikaricp", + "hk2-aopalliance-repackaged", + "hk2-api", + "hk2-javax-inject", + "hk2-locator", + "hk2-utils", + "httpclient", + "httpcore", + "httpmime", + "jackson-annotations", + "jackson-core", + "jackson-databind", + "jackson-dataformat-cbor", + "jackson-dataformat-yaml", + "jackson-datatype-jsr310", + "jakarta-activation", + "jakarta-mail", + "jasper-apache-el", + "jasper-apache-jsp", + "java-semver", + "javassist", + "javax-activation-api", + "javax-annotation-api", + "javax-json", + "javax-json-api", + "javax-persistence-api", + "javax-servlet-api", + "javax-validation-api", + "javax-ws-rs-api", + "javax-xml-soap-api", + "jaxb-api", + "jaxb-runtime", + "jaxws-api", + "jaxws-policy", + "jaxws-rt", + "jaxws-tools", + "jdom2", + "jersey-client", + "jersey-common", + "jersey-container-jetty-http", + "jersey-container-jetty-servlet", + "jersey-container-servlet", + "jersey-container-servlet-core", + "jersey-guava", + "jersey-media-jaxb", + "jersey-media-multipart", + "jersey-proxy-client", + "jersey-server", + "jetty-annotations", + "jetty-apache-jsp", + "jetty-continuation", + "jetty-http", + "jetty-io", + "jetty-jndi", + "jetty-plus", + "jetty-rewrite", + "jetty-schemas", + "jetty-security", + "jetty-server", + "jetty-servlet", + "jetty-util", + "jetty-util-ajax", + "jetty-webapp", + "jetty-xml", + "jna", + "jna-platform", + "joda-time", + "jsch", + "jsr181-api", + "log4j-1-2-api", + "log4j-api", + "log4j-core", + "mimepull", + "mssql-jdbc", + "mybatis", + "mysql-connector-j", + "netty-buffer", + "netty-codec", + "netty-codec-http", + "netty-codec-http2", + "netty-common", + "netty-handler", + "netty-reactive-streams", + "netty-reactive-streams-http", + "netty-resolver", + "netty-transport", + "netty-transport-native-unix-common", + "ojdbc8", + "osgi-core", + "osgi-resource-locator", + "oshi-core", + "postgresql", + "quartz", + "reactive-streams", + "reflections", + "rhino", + "saaj-impl", + "snakeyaml", + "stax-ex", + "staxon", + "streambuffer", + "swagger-annotations", + "swagger-core", + "swagger-integration", + "swagger-jaxrs2", + "swagger-jaxrs2-servlet-initializer", + "swagger-models", + "taglibs-standard-impl", + "taglibs-standard-spec", + "txw2", + "velocity-engine-core", + "velocity-tools-generic", + "xpp3", + "xstream", +] +server-test = [ + "byte-buddy", + "byte-buddy-agent", + "hamcrest", + "junit-v4-13-1", + "mockito-core", + "mockito-inline", + "objenesis", +] From 310a052abeb51cf46dae6982f0c1fe59ace452b5 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Wed, 30 Sep 2026 01:58:54 -0400 Subject: [PATCH 3/6] Align the Netty family on 4.1.137.Final netty-codec was bumped alone to 4.1.136.Final for a security fix, leaving the other catalog modules on 4.1.119.Final, and the classified netty-transport-native-epoll jar was pinned inline in server/build.gradle at 4.1.119.Final, outside the catalog. Netty supports only matching versions across its modules. 4.1.137 rather than codec's 4.1.136: 4.1.119 has open advisories in codec, codec-http, codec-http2, handler and native-epoll, and 4.1.136 still has GHSA-8c42-7qj2-3j46 (codec-http), CVE-2026-75595 and CVE-2026-75596 (handler). 4.1.137 is the first release with none in any shipped module; 4.1.138 carries no further security fixes. native-epoll now has a catalog entry on the netty ref, and server/build.gradle selects its linux-x86_64 classifier with variantOf(), so it can no longer drift from the family. No new runtime dependencies: the 4.1.137 modules depend only on each other. Every io.netty member reference on the project classpaths resolves as before; the only unresolved ones are netty-nio-client's references to the epoll channel classes, which live in netty-transport-classes-epoll and have never shipped (the native-epoll jar carries only the native library), unchanged by this commit. Checksums regenerated with a cold cache per CONTRIBUTING.md. CVE: CVE-2025-55163 CVE: CVE-2025-58056 CVE: CVE-2025-67735 CVE: CVE-2026-33870 CVE: CVE-2026-33871 CVE: CVE-2026-41417 CVE: CVE-2026-42580 CVE: CVE-2026-42581 CVE: CVE-2026-42584 CVE: CVE-2026-42585 CVE: CVE-2026-42587 CVE: CVE-2026-44249 CVE: CVE-2026-45416 CVE: CVE-2026-45536 CVE: CVE-2026-47244 CVE: CVE-2026-48043 CVE: CVE-2026-50010 CVE: CVE-2026-50020 CVE: CVE-2026-50560 CVE: CVE-2026-55831 CVE: CVE-2026-55833 CVE: CVE-2026-56745 CVE: CVE-2026-56746 CVE: CVE-2026-56819 CVE: CVE-2026-59898 CVE: CVE-2026-59899 CVE: CVE-2026-59900 CVE: CVE-2026-59903 CVE: CVE-2026-59921 CVE: CVE-2026-75595 CVE: CVE-2026-75596 Signed-off-by: Tony Germano --- gradle/libs.versions.toml | 6 +-- gradle/verification-metadata.xml | 85 ++++++++++++++++++++++++++++++++ server/build.gradle | 5 +- 3 files changed, 91 insertions(+), 5 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index bada6f592..850dfa615 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -24,7 +24,7 @@ jna = "4.5.2" log4j = "2.26.1" miglayout = "4.2" mockito = "5.1.1" -netty = "4.1.119.Final" +netty = "4.1.137.Final" netty-reactive-streams = "2.0.8" openhtmltopdf = "1.0.9" pdfbox = "2.0.24" @@ -209,8 +209,7 @@ mssql-jdbc = { module = "com.microsoft.sqlserver:mssql-jdbc", version = "10.2.4. mybatis = { module = "org.mybatis:mybatis", version = "3.1.1" } mysql-connector-j = { module = "com.mysql:mysql-connector-j", version = "8.4.0" } netty-buffer = { module = "io.netty:netty-buffer", version.ref = "netty" } -# off the netty ref: bumped alone for a security fix; realign the family -netty-codec = { module = "io.netty:netty-codec", version = "4.1.136.Final" } +netty-codec = { module = "io.netty:netty-codec", version.ref = "netty" } netty-codec-http = { module = "io.netty:netty-codec-http", version.ref = "netty" } netty-codec-http2 = { module = "io.netty:netty-codec-http2", version.ref = "netty" } netty-common = { module = "io.netty:netty-common", version.ref = "netty" } @@ -219,6 +218,7 @@ netty-reactive-streams = { module = "com.typesafe.netty:netty-reactive-streams", netty-reactive-streams-http = { module = "com.typesafe.netty:netty-reactive-streams-http", version.ref = "netty-reactive-streams" } netty-resolver = { module = "io.netty:netty-resolver", version.ref = "netty" } netty-transport = { module = "io.netty:netty-transport", version.ref = "netty" } +netty-transport-native-epoll = { module = "io.netty:netty-transport-native-epoll", version.ref = "netty" } netty-transport-native-unix-common = { module = "io.netty:netty-transport-native-unix-common", version.ref = "netty" } objenesis = { module = "org.objenesis:objenesis", version = "2.5.1" } ojdbc8 = { module = "com.oracle.database.jdbc:ojdbc8", version = "12.2.0.1" } diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index e55208d26..79581ecff 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -1014,6 +1014,14 @@ + + + + + + + + @@ -1030,6 +1038,14 @@ + + + + + + + + @@ -1038,6 +1054,14 @@ + + + + + + + + @@ -1046,6 +1070,14 @@ + + + + + + + + @@ -1054,6 +1086,14 @@ + + + + + + + + @@ -1062,6 +1102,14 @@ + + + + + + + + @@ -1072,6 +1120,11 @@ + + + + + @@ -1080,6 +1133,14 @@ + + + + + + + + @@ -1088,6 +1149,14 @@ + + + + + + + + @@ -1096,6 +1165,14 @@ + + + + + + + + @@ -1104,6 +1181,14 @@ + + + + + + + + diff --git a/server/build.gradle b/server/build.gradle index a8c38cb94..d928023bb 100644 --- a/server/build.gradle +++ b/server/build.gradle @@ -9,8 +9,9 @@ import java.text.SimpleDateFormat dependencies { implementation libs.bundles.server.main implementation libs.bundles.server.extensions - // classified artifact; version catalogs cannot express classifiers - implementation 'io.netty:netty-transport-native-epoll:4.1.119.Final:linux-x86_64' + // classified artifact: the catalog entry carries the version, the + // classifier is selected here + implementation(variantOf(libs.netty.transport.native.epoll) { classifier('linux-x86_64') }) testImplementation libs.bundles.server.test } From b457938014f7cc5713bdbc473301845ab3bf207b Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Thu, 1 Oct 2026 00:16:36 -0400 Subject: [PATCH 4/6] Align derby and derbytools on v4.6.0's 10.10.2.0 v4.6.0 shipped derby and derbytools 10.10.2.0. Since then derby was bumped alone to 10.11.1.1, leaving derbytools (ij, dblook) on 10.10.2.0, where it calls Derby internals that no longer exist in derby 10.11.1.1 (LocalizedResource.getMessage/getTextMessage, EmbeddedSimpleDataSource, OptimizerTrace). Put both on a shared derby version ref at 10.10.2.0, rolling derby back to what v4.6.0 ships. Moving forward to 10.12.1.1 instead was tried and does not allow an existing install to upgrade, so Derby stays on v4.6.0's release until that is investigated. The rollback costs nothing in known advisories: OSV lists the same three (CVE-2015-1832, CVE-2018-1313, CVE-2022-46337) for both 10.10.2.0 and 10.11.1.1. No checksum changes: 10.10.2.0 was already recorded in verification-metadata.xml. Signed-off-by: Tony Germano --- gradle/libs.versions.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 850dfa615..88b011538 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -8,6 +8,7 @@ asm = "9.6" awssdk = "2.15.28" bouncycastle = "1.78.1" byte-buddy = "1.14.13" +derby = "10.10.2.0" flying-saucer = "9.0.1" hapi = "2.3" hk2 = "2.4.0-b31" @@ -88,9 +89,8 @@ commons-net = { module = "commons-net:commons-net", version = "3.9.0" } commons-pool2 = { module = "org.apache.commons:commons-pool2", version = "2.3" } commons-text = { module = "org.apache.commons:commons-text", version = "1.15.0" } commons-vfs2 = { module = "org.apache.commons:commons-vfs2", version = "2.10.0" } -derby = { module = "org.apache.derby:derby", version = "10.11.1.1" } -# not on a shared ref with derby: derby was bumped alone for a security fix -derbytools = { module = "org.apache.derby:derbytools", version = "10.10.2.0" } +derby = { module = "org.apache.derby:derby", version.ref = "derby" } +derbytools = { module = "org.apache.derby:derbytools", version.ref = "derby" } ecj = { module = "org.eclipse.jdt:ecj", version = "3.19.0" } error-prone-annotations = { module = "com.google.errorprone:error_prone_annotations", version = "2.3.4" } failureaccess = { module = "com.google.guava:failureaccess", version = "1.0.1" } From d7de1962791bdc20c6d20792a0caf00e31055d18 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Wed, 30 Sep 2026 02:23:15 -0400 Subject: [PATCH 5/6] Remove duplicate JUnit and javax-annotation-api versions The catalog carried two versions of each module, with the version encoded in the alias: - junit 4.8.1 (command-test, donkey-test) and junit-v4-13-1 (server-test). 4.8.1 is affected by CVE-2020-15250; align on 4.13.1, which server tests already use and which has no known advisories. JUnit 4.13 no longer embeds Hamcrest (4.8.1 did) and its runner classes need it at runtime, so command-test and donkey-test gain the hamcrest 2.2 entry server-test already uses. Test classpaths only; nothing shipped changes. - javax-annotation-api 1.3.2 (client, server) and javax-annotation-api-v1-3 (command). Align on 1.3.2, so cli-lib now ships javax.annotation-api-1.3.2.jar like client-lib and server-lib. All versions involved were already in verification-metadata.xml; a cold-cache regeneration produced no changes. The donkey (23) and command (6) tests pass on the new classpath. Signed-off-by: Tony Germano --- gradle/libs.versions.toml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 88b011538..749674603 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -143,7 +143,6 @@ java-semver = { module = "com.github.zafarkhaja:java-semver", version = "0.10.2" javassist = { module = "org.javassist:javassist", version = "3.26.0-GA" } javax-activation-api = { module = "javax.activation:javax.activation-api", version = "1.2.0" } javax-annotation-api = { module = "javax.annotation:javax.annotation-api", version = "1.3.2" } -javax-annotation-api-v1-3 = { module = "javax.annotation:javax.annotation-api", version = "1.3" } javax-json = { module = "org.glassfish:javax.json", version = "1.0.4" } javax-json-api = { module = "javax.json:javax.json-api", version = "1.0" } javax-persistence-api = { module = "javax.persistence:persistence-api", version = "1.0" } @@ -192,9 +191,8 @@ joda-time = { module = "joda-time:joda-time", version = "2.9.9" } jsch = { module = "com.github.mwiede:jsch", version = "2.27.7" } jsr181-api = { module = "javax.jws:jsr181-api", version = "1.0-MR1" } jsr305 = { module = "com.google.code.findbugs:jsr305", version = "3.0.2" } -junit = { module = "junit:junit", version = "4.8.1" } +junit = { module = "junit:junit", version = "4.13.1" } junit-platform-console-standalone = { module = "org.junit.platform:junit-platform-console-standalone", version = "1.11.4" } -junit-v4-13-1 = { module = "junit:junit", version = "4.13.1" } libphonenumber = { module = "com.googlecode.libphonenumber:libphonenumber", version = "8.12.50" } listenablefuture = { module = "com.google.guava:listenablefuture", version = "9999.0-empty-to-avoid-conflict-with-guava" } log4j-1-2-api = { module = "org.apache.logging.log4j:log4j-1.2-api", version.ref = "log4j" } @@ -357,7 +355,7 @@ command-main = [ "jakarta-activation", "javassist", "javax-activation-api", - "javax-annotation-api-v1-3", + "javax-annotation-api", "javax-ws-rs-api", "jaxb-api", "jaxb-runtime", @@ -382,6 +380,7 @@ command-main = [ "xstream", ] command-test = [ + "hamcrest", "junit", ] donkey-main = [ @@ -423,6 +422,7 @@ donkey-main = [ donkey-test = [ "byte-buddy", "byte-buddy-agent", + "hamcrest", "hk2-aopalliance-repackaged", "hk2-javax-inject", "junit", @@ -638,7 +638,7 @@ server-test = [ "byte-buddy", "byte-buddy-agent", "hamcrest", - "junit-v4-13-1", + "junit", "mockito-core", "mockito-inline", "objenesis", From fc347fe44f40026f2b84780673b839ce97e76f3d Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Wed, 30 Sep 2026 02:30:21 -0400 Subject: [PATCH 6/6] Move the dependency-check plugin into the catalog; fix its header The OWASP dependency-check plugin version was pinned inline in the root build.gradle, the one version in the build outside the catalog. Declare it under a new [plugins] section and apply it with alias(), so it is updated alongside everything else. Same plugin and version; a cold-cache verification-metadata regeneration produced no changes. The catalog header said versions match the vendored jars byte for byte, which stopped being true with the first security bump. Describe what the file is now: non-transitive resolution means every Maven Central artifact is listed explicitly, the versions originated from the vendored-jar SHA-1 sweep but have since moved on, and checksums and distribution placement are enforced by verification-metadata.xml and vendored-layout.json. Signed-off-by: Tony Germano --- build.gradle | 2 +- gradle/libs.versions.toml | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/build.gradle b/build.gradle index 5a9dc6671..83d7e13a6 100644 --- a/build.gradle +++ b/build.gradle @@ -44,7 +44,7 @@ plugins { // vulnerability scanning: ./gradlew dependencyCheckAggregate // (replaces the old standalone dependency-check.xml Ant entry point) - id 'org.owasp.dependencycheck' version '12.2.2' + alias(libs.plugins.owasp.dependencycheck) } dependencyCheck { diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 749674603..9eb0f3a5d 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,6 +1,13 @@ -# Generated from the vendored-jar provenance sweep (SHA-1 exact -# matches against Maven Central). Versions match the vendored jars -# byte for byte; see gradle/vendored-layout.json for placement. +# Dependency versions for every module. Resolution is non-transitive +# (see build.gradle), so every Maven Central artifact the build uses is +# listed here, including ones that would normally arrive transitively. +# Jars with no Maven Central match stay vendored in each module's lib/. +# +# Originally generated by SHA-1 matching the vendored jars against Maven +# Central; versions have since moved on, mostly for security fixes. +# gradle/verification-metadata.xml enforces checksums (regenerate it with +# a cold cache after any change here, see CONTRIBUTING.md), and +# gradle/vendored-layout.json places each artifact in the distribution. [versions] # Shared by artifacts released together; bump the whole family at once. @@ -643,3 +650,6 @@ server-test = [ "mockito-inline", "objenesis", ] + +[plugins] +owasp-dependencycheck = { id = "org.owasp.dependencycheck", version = "12.2.2" }