From f97d6fd9bb84d1eefed0aaca6262c9a1ac3944bd Mon Sep 17 00:00:00 2001 From: 0xbigapple Date: Thu, 14 May 2026 17:05:33 +0800 Subject: [PATCH 1/2] chore(deps): security upgrade for dependencies Upgrade dependencies to address known CVEs: - vert.x 4.5.21 -> 4.5.27 - netty 4.1.125 -> 4.1.133.Final (12 CVEs via BOM) - bouncycastle 1.78.1 -> 1.84 - grpc 1.75.0 -> 1.81.0 - jackson-core forced to 2.18.6 - log4j (build classpath) forced to 2.25.4 - plexus-utils (build classpath) forced to 3.6.1 Replace netty-all with netty-bom + netty-buffer to allow transitive netty modules to be version-aligned by the BOM. Document the BOM extension pattern in README. Bump trident version to 1.0.0. --- README.md | 27 +- build.gradle | 15 +- core/build.gradle | 2 +- gradle/verification-metadata.xml | 585 +++++++++++++------------------ utils/build.gradle | 4 +- 5 files changed, 276 insertions(+), 357 deletions(-) diff --git a/README.md b/README.md index 2dca7a3d..841279c3 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ The latest version (built with JDK 1.8) can be found on [Maven Central](https:// ### Gradle ```groovy -implementation("io.github.tronprotocol:trident:0.11.0") +implementation("io.github.tronprotocol:trident:1.0.0") ``` ### Maven @@ -32,7 +32,7 @@ Add repo setting: io.github.tronprotocol trident - 0.11.0 + 1.0.0 ``` @@ -45,21 +45,24 @@ You can use locally built packages by the following steps: 2. Add the following to your project's `build.gradle`: ```groovy dependencies { - implementation files('libs/trident-0.11.0.jar') + implementation files('libs/trident-1.0.0.jar') implementation "com.google.guava:guava:33.0.0-jre" - implementation "io.grpc:grpc-netty-shaded:1.75.0" - implementation "io.grpc:grpc-netty:1.75.0" - implementation "io.grpc:grpc-okhttp:1.75.0" - implementation "io.grpc:grpc-protobuf:1.75.0" - implementation "io.grpc:grpc-stub:1.75.0" + implementation "io.grpc:grpc-netty-shaded:1.81.0" + implementation "io.grpc:grpc-netty:1.81.0" + implementation "io.grpc:grpc-okhttp:1.81.0" + implementation "io.grpc:grpc-protobuf:1.81.0" + implementation "io.grpc:grpc-stub:1.81.0" implementation "com.google.protobuf:protobuf-java-util:3.25.8" - implementation "org.bouncycastle:bcprov-jdk18on:1.78.1" - implementation "io.vertx:vertx-core:4.5.21" - implementation "io.netty:netty-all:4.1.125.Final" + implementation "org.bouncycastle:bcprov-jdk18on:1.84" + implementation "io.vertx:vertx-core:4.5.27" + implementation platform("io.netty:netty-bom:4.1.133.Final") + implementation "io.netty:netty-buffer" implementation "com.alibaba.fastjson2:fastjson2:2.0.55" } ``` +> **Note:** If your code directly uses other netty modules (e.g. `io.netty.channel.*`, `io.netty.handler.*`, `io.netty.codec.*`), add the corresponding artifact after the BOM without specifying a version — the version will be resolved by `netty-bom`. For example: `implementation "io.netty:netty-handler"`. + ## Quick Start **Initialize client** @@ -120,4 +123,4 @@ Starting from version 0.9.2, releases are published to Maven repository and sign ``` pub: 3149 FCA5 6377 2D11 2624 9C36 CC3F 8CEA 7B0C 74D6 uid: buildtrident@tron.network -``` \ No newline at end of file +``` diff --git a/build.gradle b/build.gradle index 7ecfdaf9..78414ce3 100644 --- a/build.gradle +++ b/build.gradle @@ -1,4 +1,4 @@ -def DEFAULT_VERSION = '0.11.0' +def DEFAULT_VERSION = '1.0.0' def DEFAULT_GROUP = 'io.github.tronprotocol' buildscript { @@ -20,6 +20,9 @@ buildscript { configurations.classpath { resolutionStrategy { force("commons-io:commons-io:2.18.0") + force("org.apache.logging.log4j:log4j-api:2.25.4") + force("org.apache.logging.log4j:log4j-core:2.25.4") + force("org.codehaus.plexus:plexus-utils:3.6.1") } } } @@ -30,9 +33,12 @@ apply plugin: 'com.github.johnrengelman.shadow' apply plugin: 'maven-publish' ext { - bouncycastleVersion = '1.78.1' + bouncycastleVersion = '1.84' junitJupiterVersion = '5.4.2' googleGuavaVersion = '33.0.0-jre' + jacksonVersion = '2.18.6' + nettyVersion = '4.1.133.Final' + vertxVersion = '4.5.27' } allprojects { @@ -74,10 +80,8 @@ allprojects { configurations.configureEach { resolutionStrategy { force("com.google.guava:guava:$googleGuavaVersion") + force("com.fasterxml.jackson.core:jackson-core:$jacksonVersion") force("com.squareup.okio:okio:3.9.0") - force("io.netty:netty-codec:4.1.125.Final") - force("io.netty:netty-codec-http:4.1.125.Final") - force("io.netty:netty-codec-http2:4.1.125.Final") force("commons-beanutils:commons-beanutils:1.11.0") } } @@ -98,6 +102,7 @@ subprojects { } dependencies { + implementation platform("io.netty:netty-bom:$nettyVersion") testImplementation "org.junit.jupiter:junit-jupiter:$junitJupiterVersion" compileOnly 'org.projectlombok:lombok:1.18.34' diff --git a/core/build.gradle b/core/build.gradle index c33f99f0..420630e7 100644 --- a/core/build.gradle +++ b/core/build.gradle @@ -6,7 +6,7 @@ plugins { description 'Trident-Java gRPC core classes' def protobufVersion = '3.25.8' -def grpcVersion = '1.75.0' +def grpcVersion = '1.81.0' def protocGenVersion = '1.60.0' // https://github.com/grpc/grpc-java/pull/11371 , 1.64.x is not supported CentOS 7. dependencies { diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index e1e7357d..33c42e9c 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -41,14 +41,9 @@ - - - - - - - - + + + @@ -61,9 +56,9 @@ - - - + + + @@ -76,12 +71,17 @@ - - - + + + + + + + + - - + + @@ -118,6 +118,14 @@ + + + + + + + + @@ -134,6 +142,14 @@ + + + + + + + + @@ -147,6 +163,11 @@ + + + + + @@ -168,6 +189,14 @@ + + + + + + + + @@ -178,6 +207,11 @@ + + + + + @@ -361,84 +395,84 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -464,294 +498,153 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + - - - - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - - - - + + + - - - - - - + + + - - - - - - + + + - - - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + - - - - - - + + + - - - + + + - - + + - - - - - - - - - - - - + + + - - - - - - - - - + + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -762,17 +655,17 @@ - - - + + + - - + + - - - + + + @@ -890,30 +783,20 @@ - - - + + + - - - - - - - + + - - - + + + - - - - - - - + + @@ -932,12 +815,12 @@ - - - + + + - - + + @@ -961,27 +844,50 @@ + + + + + + + + + + + + + + + + + + - - - + + + + + + + + - - + + @@ -1075,6 +981,11 @@ + + + + + diff --git a/utils/build.gradle b/utils/build.gradle index 165a08ab..4ede5d6c 100644 --- a/utils/build.gradle +++ b/utils/build.gradle @@ -5,8 +5,8 @@ plugins { description 'Minimal set of trident utility classes' dependencies { - implementation 'io.vertx:vertx-core:4.5.21' - implementation 'io.netty:netty-all:4.1.125.Final' + implementation "io.vertx:vertx-core:$vertxVersion" + implementation "io.netty:netty-buffer" implementation "com.google.guava:guava:$googleGuavaVersion" implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion" } From b2e022b766420c89432c2164295c6ffab0c86b2f Mon Sep 17 00:00:00 2001 From: 0xbigapple Date: Fri, 15 May 2026 15:49:02 +0800 Subject: [PATCH 2/2] feature(build): update verification-metadata.xml --- gradle/verification-metadata.xml | 77 ++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 33c42e9c..1ef1c6c7 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -41,11 +41,21 @@ + + + + + + + + + + @@ -61,6 +71,11 @@ + + + + + @@ -76,6 +91,11 @@ + + + + + @@ -678,11 +698,21 @@ + + + + + + + + + + @@ -778,11 +808,24 @@ + + + + + + + + + + + + + @@ -791,6 +834,11 @@ + + + + + @@ -895,6 +943,11 @@ + + + + + @@ -981,7 +1034,18 @@ + + + + + + + + + + + @@ -1050,6 +1114,11 @@ + + + + + @@ -1113,6 +1182,14 @@ + + + + + + + +