root
/
kafka
mirror of https://github.com/apache/kafka.git
1
0
Fork 0
Code Issues Actions 2 Packages Projects Releases Wiki Activity

KAFKA-19359: force bump commons-beanutils for CVE-2025-48734 (#19939) 

Bump the commons-beanutils for CVE-2025-48734. Since `commons-validator`
hasn't had new release with newer `commons-beanutils` versions, we manually bump it in kafka.

Reviewers: Mickael Maison <mickael.maison@gmail.com>
This commit is contained in:
Luke Chen 2025-06-11 15:23:04 +08:00 committed by GitHub
parent 7dd07eb9ba
commit ff58e90dfa
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
LICENSE-binary
View File

@ -206,11 +206,11 @@ This project bundles some components that are also licensed under the Apache
License Version 2.0: License Version 2.0:
- caffeine-3.2.0 - caffeine-3.2.0
- commons-beanutils-1.9.4 - commons-beanutils-1.11.0
- commons-collections-3.2.2 - commons-collections-3.2.2
- commons-digester-2.1 - commons-digester-2.1
- commons-lang3-3.12.0 - commons-lang3-3.12.0
- commons-logging-1.3.2 - commons-logging-1.3.5
- commons-validator-1.9.0 - commons-validator-1.9.0
- hash4j-0.22.0 - hash4j-0.22.0
- jackson-annotations-2.19.0 - jackson-annotations-2.19.0

2
build.gradle
View File

@ -193,6 +193,8 @@ allprojects {
// ensure we have a single version in the classpath despite transitive dependencies // ensure we have a single version in the classpath despite transitive dependencies
libs.scalaLibrary, libs.scalaLibrary,
libs.scalaReflect, libs.scalaReflect,
// Workaround before `commons-validator` has new release. See KAFKA-19359.
libs.commonsBeanutils,
libs.jacksonAnnotations libs.jacksonAnnotations
) )
} }

2
gradle/dependencies.gradle
View File

@ -57,6 +57,7 @@ versions += [
caffeine: "3.2.0", caffeine: "3.2.0",
bndlib: "7.1.0", bndlib: "7.1.0",
checkstyle: project.hasProperty('checkstyleVersion') ? checkstyleVersion : "10.20.2", checkstyle: project.hasProperty('checkstyleVersion') ? checkstyleVersion : "10.20.2",
commonsBeanutils: "1.11.0",
commonsValidator: "1.9.0", commonsValidator: "1.9.0",
classgraph: "4.8.179", classgraph: "4.8.179",
gradle: "8.14.1", gradle: "8.14.1",
@ -147,6 +148,7 @@ libs += [
bndlib:"biz.aQute.bnd:biz.aQute.bndlib:$versions.bndlib", bndlib:"biz.aQute.bnd:biz.aQute.bndlib:$versions.bndlib",
caffeine: "com.github.ben-manes.caffeine:caffeine:$versions.caffeine", caffeine: "com.github.ben-manes.caffeine:caffeine:$versions.caffeine",
classgraph: "io.github.classgraph:classgraph:$versions.classgraph", classgraph: "io.github.classgraph:classgraph:$versions.classgraph",
commonsBeanutils: "commons-beanutils:commons-beanutils:$versions.commonsBeanutils",
commonsValidator: "commons-validator:commons-validator:$versions.commonsValidator", commonsValidator: "commons-validator:commons-validator:$versions.commonsValidator",
jacksonAnnotations: "com.fasterxml.jackson.core:jackson-annotations:$versions.jackson", jacksonAnnotations: "com.fasterxml.jackson.core:jackson-annotations:$versions.jackson",
jacksonDatabind: "com.fasterxml.jackson.core:jackson-databind:$versions.jackson", jacksonDatabind: "com.fasterxml.jackson.core:jackson-databind:$versions.jackson",