From e56754cc0d3700c7a804468f9e8a644b63b1ed05 Mon Sep 17 00:00:00 2001 From: Vladimir Sitnikov Date: Wed, 3 Jun 2026 10:17:22 +0300 Subject: [PATCH 1/4] fix(deps): update org.bouncycastle to v1.84 Bump bcmail/bcpkix/bcprov-jdk18on from 1.82 to 1.84 for the latest upstream security and bug fixes. Regenerate dependency verification metadata; bouncycastle is verified by trusted PGP key, so no per-jar checksums change. Co-Authored-By: Claude Opus 4.8 --- gradle/verification-metadata.xml | 20 ++++++++++++++++++++ src/bom-thirdparty/build.gradle.kts | 6 +++--- 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index ae138570c88..41a3eddf5f6 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -653,6 +653,21 @@ + + + + + + + + + + + + + + + @@ -959,6 +974,11 @@ + + + + + diff --git a/src/bom-thirdparty/build.gradle.kts b/src/bom-thirdparty/build.gradle.kts index 51d51af50c7..9e739b4a0e9 100644 --- a/src/bom-thirdparty/build.gradle.kts +++ b/src/bom-thirdparty/build.gradle.kts @@ -122,9 +122,9 @@ dependencies { api("org.apache.velocity:velocity:1.7") api("org.apache.xmlgraphics:xmlgraphics-commons:2.11") api("org.apiguardian:apiguardian-api:1.1.2") - api("org.bouncycastle:bcmail-jdk18on:1.82") - api("org.bouncycastle:bcpkix-jdk18on:1.82") - api("org.bouncycastle:bcprov-jdk18on:1.82") + api("org.bouncycastle:bcmail-jdk18on:1.84") + api("org.bouncycastle:bcpkix-jdk18on:1.84") + api("org.bouncycastle:bcprov-jdk18on:1.84") api("org.brotli:dec:0.1.2") api("org.freemarker:freemarker:2.3.34") api("org.glassfish.jaxb:txw2:4.0.6") From 08010862b0cfc3ba2e4f5cedc6773fdfdf1cecad Mon Sep 17 00:00:00 2001 From: Vladimir Sitnikov Date: Wed, 3 Jun 2026 10:20:55 +0300 Subject: [PATCH 2/4] fix(deps): update org.apache.logging.log4j to v2.26.0 Bump log4j-1.2-api/api/core/slf4j2-impl from 2.25.3 to 2.26.0. Regenerate dependency verification metadata and the expected release jar list. Co-Authored-By: Claude Opus 4.8 --- gradle/verification-metadata.xml | 5 +++++ src/bom-thirdparty/build.gradle.kts | 8 ++++---- src/dist/src/dist/expected_release_jars.csv | 8 ++++---- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 41a3eddf5f6..9309e455537 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -257,6 +257,11 @@ + + + + + diff --git a/src/bom-thirdparty/build.gradle.kts b/src/bom-thirdparty/build.gradle.kts index 9e739b4a0e9..ffd0b4073f5 100644 --- a/src/bom-thirdparty/build.gradle.kts +++ b/src/bom-thirdparty/build.gradle.kts @@ -112,10 +112,10 @@ dependencies { api("org.apache.httpcomponents:httpcore-nio:4.4.16") api("org.apache.httpcomponents:httpcore:4.4.16") api("org.apache.httpcomponents:httpmime:4.5.14") - api("org.apache.logging.log4j:log4j-1.2-api:2.25.3") - api("org.apache.logging.log4j:log4j-api:2.25.3") - api("org.apache.logging.log4j:log4j-core:2.25.3") - api("org.apache.logging.log4j:log4j-slf4j2-impl:2.25.3") + api("org.apache.logging.log4j:log4j-1.2-api:2.26.0") + api("org.apache.logging.log4j:log4j-api:2.26.0") + api("org.apache.logging.log4j:log4j-core:2.26.0") + api("org.apache.logging.log4j:log4j-slf4j2-impl:2.26.0") api("org.apache.rat:apache-rat:0.17") api("org.apache.tika:tika-core:3.2.3") api("org.apache.tika:tika-parsers:3.2.3") diff --git a/src/dist/src/dist/expected_release_jars.csv b/src/dist/src/dist/expected_release_jars.csv index 01ee126af4f..12ef9a5b9e2 100644 --- a/src/dist/src/dist/expected_release_jars.csv +++ b/src/dist/src/dist/expected_release_jars.csv @@ -102,10 +102,10 @@ 675271,kotlinx-datetime-jvm-0.6.2.jar 996,lets-plot-batik-4.8.0.jar 996,lets-plot-common-4.8.0.jar -359213,log4j-1.2-api-2.25.3.jar -350610,log4j-api-2.25.3.jar -2018402,log4j-core-2.25.3.jar -30213,log4j-slf4j2-impl-2.25.3.jar +359197,log4j-1.2-api-2.26.0.jar +351126,log4j-api-2.26.0.jar +2015101,log4j-core-2.26.0.jar +30211,log4j-slf4j2-impl-2.26.0.jar 519087,mail-1.5.0-b01.jar 120556,miglayout-core-11.4.3.jar 23361,miglayout-swing-11.4.3.jar From ced20eb2d0f1a062b3012c1fecc8dc9653aaa90e Mon Sep 17 00:00:00 2001 From: Vladimir Sitnikov Date: Wed, 3 Jun 2026 10:23:24 +0300 Subject: [PATCH 3/4] fix(deps): update org.apache.activemq to v6.2.6 Bump activemq-broker/client/spring (test scope) from 6.2.0 to 6.2.6. Regenerate dependency verification metadata; activemq is test-only, so the release jar list is unchanged. Co-Authored-By: Claude Opus 4.8 --- gradle/verification-metadata.xml | 10 +++++++++- src/bom-testing/build.gradle.kts | 6 +++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 9309e455537..69fb2e633dd 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -211,7 +211,10 @@ - + + + + @@ -633,6 +636,11 @@ + + + + + diff --git a/src/bom-testing/build.gradle.kts b/src/bom-testing/build.gradle.kts index 62af8d9d0e6..a79455bce90 100644 --- a/src/bom-testing/build.gradle.kts +++ b/src/bom-testing/build.gradle.kts @@ -44,9 +44,9 @@ dependencies { api("net.bytebuddy:byte-buddy:1.17.8") api("nl.jqno.equalsverifier:equalsverifier:4.3") // activemq-all should not be used as it provides secondary slf4j binding - api("org.apache.activemq:activemq-broker:6.2.0") - api("org.apache.activemq:activemq-client:6.2.0") - api("org.apache.activemq:activemq-spring:6.2.0") + api("org.apache.activemq:activemq-broker:6.2.6") + api("org.apache.activemq:activemq-client:6.2.6") + api("org.apache.activemq:activemq-spring:6.2.6") api("org.apache.ftpserver:ftplet-api:1.2.1") api("org.apache.ftpserver:ftpserver-core:1.2.1") api("org.apache.mina:mina-core:2.2.5") From 1270596b5e3092707ea4bc6bcf5c92683b459495 Mon Sep 17 00:00:00 2001 From: Vladimir Sitnikov Date: Wed, 3 Jun 2026 10:29:52 +0300 Subject: [PATCH 4/4] fix(deps): update org.apache.mina to v2.2.8 Bump mina-core (test scope) from 2.2.5 to 2.2.8, the latest stable 2.x release. Verification metadata is unchanged: mina is test-only and already covered by a trusted PGP key. Co-Authored-By: Claude Opus 4.8 --- src/bom-testing/build.gradle.kts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/bom-testing/build.gradle.kts b/src/bom-testing/build.gradle.kts index a79455bce90..d7d81cb21c2 100644 --- a/src/bom-testing/build.gradle.kts +++ b/src/bom-testing/build.gradle.kts @@ -49,7 +49,7 @@ dependencies { api("org.apache.activemq:activemq-spring:6.2.6") api("org.apache.ftpserver:ftplet-api:1.2.1") api("org.apache.ftpserver:ftpserver-core:1.2.1") - api("org.apache.mina:mina-core:2.2.5") + api("org.apache.mina:mina-core:2.2.8") api("org.hamcrest:hamcrest-core:3.0") api("org.hamcrest:hamcrest-library:3.0") api("org.hamcrest:hamcrest:3.0")