Skip to content

gradle-8/8.14.1-r0: cve remediation #54136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kbsteere merged 3 commits into from
May 27, 2025
Merged

gradle-8/8.14.1-r0: cve remediation #54136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5613f5f
gradle-8/8.14.1-r0: fix GHSA-vrpq-qp53-qv56
octo-sts[bot] May 23, 2025
0fd5ba4
fix CVE-2025-4949 by upgrading to jgit 6.10.1.202505221210-r
kbsteere May 27, 2025
09ca73a
removing pom.xml since this is gradle which doesn't use pom files
kbsteere May 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions gradle-8.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ package:
version: "8.14.1"
# For version upgrades check whether patches are still needed.
# Upstream changes are being tracked in https://github.com/gradle/gradle/issues/25945
epoch: 0
epoch: 1
description: A Java project management and project comprehension tool.
copyright:
- license: Apache-2.0
Expand Down Expand Up @@ -40,7 +40,7 @@ pipeline:

- uses: patch
with:
patches: upgrade-deps.patch
patches: upgrade-deps.patch fix-CVE-2025-4949.patch

- runs: |
export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
Expand Down
41 changes: 41 additions & 0 deletions gradle-8/fix-CVE-2025-4949.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
From 46ec6ee22ad0307ec435b5e37d39a47b3d4f0a04 Mon Sep 17 00:00:00 2001
From: Kyle Steere <[email protected]>
Date: Tue, 27 May 2025 13:10:11 -0500
Subject: [PATCH] fix CVE-2025-4949 by upgrading to jgit 6.10.1.202505221210-r

Signed-off-by: Kyle Steere <[email protected]>
---
build-logic-commons/build-platform/build.gradle.kts | 2 +-
packaging/distributions-dependencies/build.gradle.kts | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/build-logic-commons/build-platform/build.gradle.kts b/build-logic-commons/build-platform/build.gradle.kts
index 8eca912a8be..764b5d10c41 100644
--- a/build-logic-commons/build-platform/build.gradle.kts
+++ b/build-logic-commons/build-platform/build.gradle.kts
@@ -75,7 +75,7 @@ dependencies {
api("org.codehaus.groovy:groovy:$groovyVersion")
api("org.codehaus.groovy.modules.http-builder:http-builder:0.7.2") // TODO maybe change group name when upgrading to Groovy 4
api("org.codenarc:CodeNarc:$codenarcVersion")
- api("org.eclipse.jgit:org.eclipse.jgit:5.13.3.202401111512-r")
+ api("org.eclipse.jgit:org.eclipse.jgit:6.10.1.202505221210-r")
api("org.javassist:javassist:3.30.2-GA")
api("org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.9.0")
api("org.jsoup:jsoup:1.15.3")
diff --git a/packaging/distributions-dependencies/build.gradle.kts b/packaging/distributions-dependencies/build.gradle.kts
index aa8d03e3d75..7c2880b76ae 100644
--- a/packaging/distributions-dependencies/build.gradle.kts
+++ b/packaging/distributions-dependencies/build.gradle.kts
@@ -120,8 +120,8 @@ dependencies {
api(libs.jclToSlf4j) { version { strictly(slf4jVersion) }}
api(libs.jcommander) { version { strictly("1.78") }}
api(libs.jetbrainsAnnotations) { version { strictly("24.0.1") }}
- api(libs.jgit) { version { strictly("5.13.3.202401111512-r"); because("6.x requires Java 11") }}
- api(libs.jgitSsh) { version { strictly("5.13.3.202401111512-r") }}
+ api(libs.jgit) { version { strictly("6.10.1.202505221210-r"); because("6.x requires Java 11") }}
+ api(libs.jgitSsh) { version { strictly("6.10.1.202505221210-r") }}
api(libs.joda) { version { strictly("2.12.2") }}
api(libs.joptSimple) { version { strictly("5.0.4"); because("needed to create profiler in Gradle profiler API") }}
api(libs.jsch) { version { strictly("0.2.16") }}
--
2.43.0
Loading