Skip to content

chore: fix CVE-2025-67735 in 2.19 #4686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyek-bot wants to merge 6 commits into from
Closed

chore: fix CVE-2025-67735 in 2.19 #4686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4e9f17a
chore fix cve CVE-2025-67735
pyek-bot Mar 3, 2026
df2fca1
force log4j to use version from core
pyek-bot Mar 3, 2026
cc0fa69
chore: fix log4j dependency version to use version from core
pyek-bot Mar 3, 2026
a24986e
test: ci fix
pyek-bot Mar 3, 2026
aa75b7d
Revert "test: ci fix"
pyek-bot Mar 3, 2026
6680113
fix: shadow build issue after change in core and upgrade gradle to wo…
pyek-bot Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,15 +83,15 @@ subprojects {
resolutionStrategy.force "org.apache.commons:commons-lang3:${versions.commonslang}"
resolutionStrategy.force 'software.amazon.awssdk:bom:2.32.29'

resolutionStrategy.force 'io.netty:netty-buffer:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-codec:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-codec-http:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-codec-http2:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-common:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-handler:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-resolver:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-transport:4.1.125.Final'
resolutionStrategy.force 'io.netty:netty-transport-native-unix-common:4.1.125.Final'
resolutionStrategy.force "io.netty:netty-buffer:${versions.netty}"

@brianf-aws brianf-aws Mar 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool looks like OpenSearch core addressed this issue to

https://github.com/opensearch-project/OpenSearch/blob/880832d96934729075297f8dac21636f4a860529/gradle/libs.versions.toml#L37

resolutionStrategy.force "io.netty:netty-codec:${versions.netty}"
resolutionStrategy.force "io.netty:netty-codec-http:${versions.netty}"
resolutionStrategy.force "io.netty:netty-codec-http2:${versions.netty}"
resolutionStrategy.force "io.netty:netty-common:${versions.netty}"
resolutionStrategy.force "io.netty:netty-handler:${versions.netty}"
resolutionStrategy.force "io.netty:netty-resolver:${versions.netty}"
resolutionStrategy.force "io.netty:netty-transport:${versions.netty}"
resolutionStrategy.force "io.netty:netty-transport-native-unix-common:${versions.netty}"
}
}

Expand Down
2 changes: 1 addition & 1 deletion client/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ plugins {
id 'java'
id "io.freefair.lombok"
id 'jacoco'
id 'com.github.johnrengelman.shadow'
id 'com.gradleup.shadow'
id 'maven-publish'
id 'com.diffplug.spotless' version '6.23.0'
id 'signing'
Expand Down
6 changes: 3 additions & 3 deletions common/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
//TODO: cleanup gradle config file, some overlap
plugins {
id 'java'
id 'com.github.johnrengelman.shadow'
id 'com.gradleup.shadow'
id 'jacoco'
id "io.freefair.lombok"
id 'com.diffplug.spotless' version '6.25.0'
Expand Down Expand Up @@ -90,12 +90,12 @@ spotless {
}
}

shadowJar {
tasks.named('shadowJar') {
destinationDirectory = file("${project.buildDir}/distributions")
archiveClassifier.set(null)
exclude 'META-INF/maven/com.google.guava/**'
exclude 'com/google/thirdparty/**'
relocate 'com.google.common', 'org.opensearch.ml.repackage.com.google.common' // dependency of cron-utils
relocate 'com.google.common', 'org.opensearch.ml.repackage.com.google.common'
}

jar {
Expand Down
9 changes: 2 additions & 7 deletions gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,8 @@
#
# Copyright OpenSearch Contributors
# SPDX-License-Identifier: Apache-2.0
#

distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.11.1-bin.zip
distributionSha256Sum=16f2b95838c1ddcf7242b1c39e7bbbb43c842f1f1a1a0dc4959b6d4d68abcac3
distributionUrl=https\://services.gradle.org/distributions/gradle-9.2.0-all.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
distributionSha256Sum=f397b287023acdba1e9f6fc5ea72d22dd63669d59ed4a289a29b1a76eee151c6
20 changes: 10 additions & 10 deletions gradlew.bat
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions plugin/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ dependencies {
implementation group: 'com.google.code.gson', name: 'gson', version: '2.11.0'
implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.18.0'
implementation group: 'org.apache.commons', name: 'commons-math3', version: '3.6.1'
implementation "org.apache.logging.log4j:log4j-slf4j-impl:2.19.0"
implementation "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
testImplementation group: 'commons-io', name: 'commons-io', version: '2.15.1'
implementation group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
implementation ('com.jayway.jsonpath:json-path:2.9.0') {
Expand Down Expand Up @@ -415,8 +415,8 @@ configurations.all {
resolutionStrategy.force "org.apache.httpcomponents.client5:httpclient5:5.4.3"
resolutionStrategy.force "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
resolutionStrategy.force "com.fasterxml.jackson.core:jackson-core:${versions.jackson_databind}"
resolutionStrategy.force "org.apache.logging.log4j:log4j-api:2.24.2"
resolutionStrategy.force "org.apache.logging.log4j:log4j-core:2.24.2"
resolutionStrategy.force "org.apache.logging.log4j:log4j-api:${versions.log4j}"
resolutionStrategy.force "org.apache.logging.log4j:log4j-core:${versions.log4j}"
resolutionStrategy.force "jakarta.json:jakarta.json-api:2.1.3"
resolutionStrategy.force 'commons-beanutils:commons-beanutils:1.11.0'
}
Expand Down
4 changes: 2 additions & 2 deletions spi/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import com.github.jengelman.gradle.plugins.shadow.ShadowBasePlugin
import org.opensearch.gradle.test.RestIntegTestTask

plugins {
id 'com.github.johnrengelman.shadow'
id 'com.gradleup.shadow'
id 'jacoco'
id 'maven-publish'
id 'signing'
Expand Down Expand Up @@ -56,7 +56,7 @@ configurations.all {
}
}

shadowJar {
tasks.named('shadowJar') {
archiveClassifier = null
}

Expand Down
Loading