Skip to content

Commit 6155428

Browse files
danjasuwdanjasuw
committed
Bump dependencies to address Dependabot security advisories
webapp: Spring Boot 4.1.0 -> 4.1.1 (its BOM brings patched netty 4.2.17, httpcore5 5.4.3, httpclient5 5.6.4, log4j 2.25.5, jackson-2 2.21.5). All four modules: AWS SDK s3 + apache-client 2.49.3 -> 2.55.7 (transitively resolves netty to a patched 4.1.138 and httpclient5 to 5.6.4 in the plain-Java importer modules). Importer/run_importer/feature_detection: jackson-core + jackson-databind 2.22.1 -> 2.22.2 (Duration-DoS CVE-2026-68497). No BOM version overrides added; runtime Tomcat is patched via the webapp Docker base image, so tomcat-embed-core (providedCompile) and the transitive jackson-3 remain as compile-time-only advisories.
1 parent 650fcbe commit 6155428

4 files changed

Lines changed: 15 additions & 15 deletions

File tree

‎limelight_feature_detection_run_import/build.gradle‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,10 @@ dependencies {
5454
// AWS S3
5555

5656
// https://mvnrepository.com/artifact/software.amazon.awssdk/s3
57-
implementation 'software.amazon.awssdk:s3:2.49.3'
57+
implementation 'software.amazon.awssdk:s3:2.55.7'
5858

5959
// https://mvnrepository.com/artifact/software.amazon.awssdk/apache-client
60-
implementation 'software.amazon.awssdk:apache-client:2.49.3'
60+
implementation 'software.amazon.awssdk:apache-client:2.55.7'
6161

6262

6363
// OLD V1
@@ -103,10 +103,10 @@ dependencies {
103103
implementation 'org.apache.logging.log4j:log4j-1.2-api:2.26.1'
104104

105105
// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core
106-
implementation 'com.fasterxml.jackson.core:jackson-core:2.22.1'
106+
implementation 'com.fasterxml.jackson.core:jackson-core:2.22.2'
107107

108108
// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind
109-
implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.1'
109+
implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.2'
110110

111111

112112
// JAXB dependencies (Required for Java 11+)

‎limelight_importer/build.gradle‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,10 @@ dependencies {
8383
// AWS S3
8484

8585
// https://mvnrepository.com/artifact/software.amazon.awssdk/s3
86-
implementation 'software.amazon.awssdk:s3:2.49.3'
86+
implementation 'software.amazon.awssdk:s3:2.55.7'
8787

8888
// https://mvnrepository.com/artifact/software.amazon.awssdk/apache-client
89-
implementation 'software.amazon.awssdk:apache-client:2.49.3'
89+
implementation 'software.amazon.awssdk:apache-client:2.55.7'
9090

9191

9292
// OLD V1
@@ -134,10 +134,10 @@ dependencies {
134134
implementation 'org.apache.logging.log4j:log4j-1.2-api:2.26.1'
135135

136136
// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core
137-
implementation 'com.fasterxml.jackson.core:jackson-core:2.22.1'
137+
implementation 'com.fasterxml.jackson.core:jackson-core:2.22.2'
138138

139139
// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind
140-
implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.1'
140+
implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.2'
141141

142142

143143
// JAXB 4.0 (jakarta.xml.bind) - jakarta-only. Binds the published jakarta limelight-import-api

‎limelight_run_importer/build.gradle‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,10 +48,10 @@ dependencies {
4848
// AWS S3
4949

5050
// https://mvnrepository.com/artifact/software.amazon.awssdk/s3
51-
implementation 'software.amazon.awssdk:s3:2.49.3'
51+
implementation 'software.amazon.awssdk:s3:2.55.7'
5252

5353
// https://mvnrepository.com/artifact/software.amazon.awssdk/apache-client
54-
implementation 'software.amazon.awssdk:apache-client:2.49.3'
54+
implementation 'software.amazon.awssdk:apache-client:2.55.7'
5555

5656

5757
// OLD V1
@@ -98,10 +98,10 @@ dependencies {
9898
implementation 'org.apache.logging.log4j:log4j-1.2-api:2.26.1'
9999

100100
// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core
101-
implementation 'com.fasterxml.jackson.core:jackson-core:2.22.1'
101+
implementation 'com.fasterxml.jackson.core:jackson-core:2.22.2'
102102

103103
// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind
104-
implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.1'
104+
implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.2'
105105

106106

107107

‎limelight_webapp/build.gradle‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ plugins {
3333
id 'war'
3434
id 'eclipse'
3535
id 'eclipse-wtp' // Required to manipulate Eclipse Web Tools Platform settings
36-
id "org.springframework.boot" version "4.1.0"
36+
id "org.springframework.boot" version "4.1.1"
3737
id "io.spring.dependency-management" version "1.1.7"
3838
id 'org.ajoberstar.grgit' version '5.3.3'
3939
}
@@ -134,10 +134,10 @@ dependencies {
134134
// AWS S3
135135

136136
// https://mvnrepository.com/artifact/software.amazon.awssdk/s3
137-
implementation 'software.amazon.awssdk:s3:2.49.3'
137+
implementation 'software.amazon.awssdk:s3:2.55.7'
138138

139139
// https://mvnrepository.com/artifact/software.amazon.awssdk/apache-client
140-
implementation 'software.amazon.awssdk:apache-client:2.49.3'
140+
implementation 'software.amazon.awssdk:apache-client:2.55.7'
141141

142142

143143
// OLD V1

0 commit comments

Comments
 (0)