From 2ce600df25cab0288db4b0363ea1c1b7c41180f7 Mon Sep 17 00:00:00 2001 From: Wu Sheng Date: Mon, 2 Nov 2026 20:28:18 +0800 Subject: [PATCH] Bump test and tooling dependencies to fix security alerts Plugin-test tooling (test/plugin/pom.xml, inherited by runner-helper, agent-test-tools and containers; still built on JDK 8): - junit:junit 4.11 -> 4.13.2, CVE-2020-15250 - com.google.guava:guava 30.1.1-jre -> 33.7.2-jre, CVE-2020-8908, CVE-2023-2976, CVE-2026-102554 - org.yaml:snakeyaml 1.24 -> 2.7, CVE-2022-1471 and 7 others. The runner-helper only calls Yaml#loadAs with a root class, which 2.x keeps. test/plugin/runner-helper: - org.freemarker:freemarker 2.3.28 -> 2.3.35, CVE-2026-84939 - junit:junit 4.12 -> 4.13.2 (test scope) test/plugin/archetypes/tomcat archetype: - org.apache.logging.log4j:log4j-core/log4j-api 2.8.1 -> 2.25.5, CVE-2021-44228, CVE-2021-45046 and others Unit-test junit.version overrides 4.12 -> 4.13.2 (CVE-2020-15250) in httpClient-4.x-plugin, httpclient-5.x-plugin, solon-2.x-plugin, websphere-liberty-23.x-plugin and apm-test-tools. E2E services (test/e2e/base): - ch.qos.logback:logback-classic/logback-core 1.2.3 -> 1.2.13 (provider), CVE-2023-6378 - com.google.guava:guava 30.1.1-jre -> 33.7.2-jre (provider, consumer) Provided-scope plugin and toolkit dependencies are compile-only compatibility targets and are left unchanged. h2 1.4.199 in the E2E provider is left as is: every fix is in H2 2.x, which reserves the USER keyword the provider's User entity maps to and needs a newer Hibernate than the E2E services' Spring Boot 2.2.5 parent provides. --- apm-sniffer/apm-sdk-plugin/httpClient-4.x-plugin/pom.xml | 2 +- apm-sniffer/apm-sdk-plugin/httpclient-5.x-plugin/pom.xml | 2 +- apm-sniffer/apm-sdk-plugin/solon-2.x-plugin/pom.xml | 2 +- .../apm-sdk-plugin/websphere-liberty-23.x-plugin/pom.xml | 2 +- apm-sniffer/apm-test-tools/pom.xml | 2 +- test/e2e/base/pom.xml | 2 +- test/e2e/base/provider/pom.xml | 2 +- .../tomcat/src/main/resources/archetype-resources/pom.xml | 4 ++-- test/plugin/pom.xml | 6 +++--- test/plugin/runner-helper/pom.xml | 4 ++-- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/apm-sniffer/apm-sdk-plugin/httpClient-4.x-plugin/pom.xml b/apm-sniffer/apm-sdk-plugin/httpClient-4.x-plugin/pom.xml index e1c0c17659..d3b2c0814b 100644 --- a/apm-sniffer/apm-sdk-plugin/httpClient-4.x-plugin/pom.xml +++ b/apm-sniffer/apm-sdk-plugin/httpClient-4.x-plugin/pom.xml @@ -34,7 +34,7 @@ UTF-8 4.3 - 4.12 + 4.13.2 diff --git a/apm-sniffer/apm-sdk-plugin/httpclient-5.x-plugin/pom.xml b/apm-sniffer/apm-sdk-plugin/httpclient-5.x-plugin/pom.xml index 518be17d7f..4dd20cb594 100644 --- a/apm-sniffer/apm-sdk-plugin/httpclient-5.x-plugin/pom.xml +++ b/apm-sniffer/apm-sdk-plugin/httpclient-5.x-plugin/pom.xml @@ -33,7 +33,7 @@ UTF-8 5.0 - 4.12 + 4.13.2 diff --git a/apm-sniffer/apm-sdk-plugin/solon-2.x-plugin/pom.xml b/apm-sniffer/apm-sdk-plugin/solon-2.x-plugin/pom.xml index c086d90481..fdfdaefbf6 100644 --- a/apm-sniffer/apm-sdk-plugin/solon-2.x-plugin/pom.xml +++ b/apm-sniffer/apm-sdk-plugin/solon-2.x-plugin/pom.xml @@ -34,7 +34,7 @@ UTF-8 4.3 - 4.12 + 4.13.2 diff --git a/apm-sniffer/apm-sdk-plugin/websphere-liberty-23.x-plugin/pom.xml b/apm-sniffer/apm-sdk-plugin/websphere-liberty-23.x-plugin/pom.xml index a4a492986d..c456d322b3 100644 --- a/apm-sniffer/apm-sdk-plugin/websphere-liberty-23.x-plugin/pom.xml +++ b/apm-sniffer/apm-sdk-plugin/websphere-liberty-23.x-plugin/pom.xml @@ -28,7 +28,7 @@ websphere-liberty-23.x-plugin - 4.12 + 4.13.2 diff --git a/apm-sniffer/apm-test-tools/pom.xml b/apm-sniffer/apm-test-tools/pom.xml index e0debb45c0..d31af4f335 100644 --- a/apm-sniffer/apm-test-tools/pom.xml +++ b/apm-sniffer/apm-test-tools/pom.xml @@ -32,7 +32,7 @@ http://maven.apache.org - 4.12 + 4.13.2 diff --git a/test/e2e/base/pom.xml b/test/e2e/base/pom.xml index 63b6a687f2..f29185c51d 100644 --- a/test/e2e/base/pom.xml +++ b/test/e2e/base/pom.xml @@ -52,7 +52,7 @@ ${java.version} UTF-8 2.7.18 - 30.1.1-jre + 33.7.2-jre 1.18.20 diff --git a/test/e2e/base/provider/pom.xml b/test/e2e/base/provider/pom.xml index 841c045b39..e59214e374 100644 --- a/test/e2e/base/provider/pom.xml +++ b/test/e2e/base/provider/pom.xml @@ -33,7 +33,7 @@ 1.2.17 2.7 - 1.2.3 + 1.2.13 2.1.2.RELEASE 1.4.199 diff --git a/test/plugin/archetypes/tomcat/src/main/resources/archetype-resources/pom.xml b/test/plugin/archetypes/tomcat/src/main/resources/archetype-resources/pom.xml index 54e1c8832f..4a0bbffb84 100644 --- a/test/plugin/archetypes/tomcat/src/main/resources/archetype-resources/pom.xml +++ b/test/plugin/archetypes/tomcat/src/main/resources/archetype-resources/pom.xml @@ -47,12 +47,12 @@ org.apache.logging.log4j log4j-api - 2.8.1 + 2.25.5 org.apache.logging.log4j log4j-core - 2.8.1 + 2.25.5 org.projectlombok diff --git a/test/plugin/pom.xml b/test/plugin/pom.xml index 20643ee6a1..b63aaf5294 100644 --- a/test/plugin/pom.xml +++ b/test/plugin/pom.xml @@ -53,11 +53,11 @@ UTF-8 - 4.11 - 30.1.1-jre + 4.13.2 + 33.7.2-jre 2.8.9 1.18.20 - 1.24 + 2.7 3.14.0 true diff --git a/test/plugin/runner-helper/pom.xml b/test/plugin/runner-helper/pom.xml index c0109da433..a60aa37e69 100644 --- a/test/plugin/runner-helper/pom.xml +++ b/test/plugin/runner-helper/pom.xml @@ -34,7 +34,7 @@ junit junit - 4.12 + 4.13.2 test @@ -48,7 +48,7 @@ org.freemarker freemarker - 2.3.28 + 2.3.35