Bump jersey to latest 2.x and 3.x versions #3307
Conversation
Generate changelog in
|
| # Run ./gradlew checkClassUniqueness --fix to update this file | ||
|
|
||
| ## runtimeClasspath | ||
| [javax.el:javax.el-api, org.glassfish:jakarta.el] |
There was a problem hiding this comment.
I don't understand why this is needed, when org.glassfish:jakarta.el seems to be removed from our versions.lock 🤔
There was a problem hiding this comment.
This is because
- We're forcing down the version in
- We were not forcing down the version of
org.glassfish:jakarta.el, so we would get the higher version from the versions.lock file
- The jersey bump removed
org.glassfish:jakarta.elas a transitive dependency, thus not forcing the version up anymore, leading to us using the requested 3.0.4, which has the conflicts
Because we were actually using a higher version anyway, which didn't contain the classes, we can just exclude it as a transitive dependency, to continue relying on javax.el:javax.el-api.
| version { | ||
| strictly jerseyVersion | ||
| } | ||
| // This conflicts with org.glassfish:jakarta.el (which contains the same classes), when at the version requested by 2.40 |
There was a problem hiding this comment.
the details of CVE-2025-12383 are a bit unclear right now, but perhaps we should bump https://github.com/palantir/conjure-java-runtime/pull/3307/files#diff-5f9e3e7b8a9bffc2554597f5c9408adc3b41614674d053b9cdf6c1b8ba08c4cbR4 to the latest version as well (2.47)?
✅ Successfully generated changelog entry!Need to regenerate?Simply interact with the changelog bot comment again to regenerate these entries. 📋Changelog Preview💡 Improvements
|
aldexis
changed the title
|
👍 |
|
Released 8.26.0 |
Before this PR
We're relying on Jersey 3.1.3, which contains https://nvd.nist.gov/vuln/detail/CVE-2025-12383.
Sounds like there is 4.0.0 that has released, but bumping an entire major version seems riskier, and the vuln has been addressed as of 3.1.10.
Here are the release notes for the various versions:
After this PR
==COMMIT_MSG==
Bump jersey to latest 3.x version
==COMMIT_MSG==
Possible downsides?
There are a lot of changes (two years worth of them), so determining potential impact is hard.