Skip to content

fix: bump dependencies for CVE fixes on release-1.17#1789

Merged
siri-varma merged 1 commit into
dapr:release-1.17from
javier-aliaga:fix/release-1.17-cves
Jul 17, 2026
Merged

fix: bump dependencies for CVE fixes on release-1.17#1789
siri-varma merged 1 commit into
dapr:release-1.17from
javier-aliaga:fix/release-1.17-cves

Conversation

@javier-aliaga

Copy link
Copy Markdown
Contributor

Mirror the 1.18 CVE fixes (#1788) and address FOSSA findings:

CVE-2026-40973 remains on spring-boot 3.4.13: no fix exists on the OSS-EOL 3.4.x line; accepted and ignored in FOSSA.

Description

Please explain the changes you've made

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

  • Code compiles correctly
  • Created/updated tests
  • Extended the documentation

Mirror the 1.18 CVE fixes (dapr#1788) and address FOSSA findings:

- netty 4.1.132 -> 4.1.135.Final (CVE-2026-41417, CVE-2026-42578,
  CVE-2026-42580..42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-47244,
  CVE-2026-48043, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560)
- jackson 2.21.2 -> 2.21.5 and Jackson 3 BOM 3.1.1 -> 3.1.4
  (CVE-2026-54512..54518)
- opentelemetry 1.41.0 -> 1.62.0 (CVE-2026-45292), imported before the
  Spring Boot BOM so the override wins
- logback 1.5.25 -> 1.5.35 (CVE-2026-9828, CVE-2026-10532)
- tomcat 10.1.52 -> 10.1.55 (CVE-2026-25854, CVE-2026-29129,
  CVE-2026-32990, CVE-2026-34483, CVE-2026-41284, CVE-2026-41293,
  CVE-2026-42498, CVE-2026-43512..43515)
- spring-framework-bom 6.2.18 override (CVE-2026-22735, CVE-2026-22737,
  CVE-2026-22741, CVE-2026-22745)
- Spring Boot 4 modules 4.0.5 -> 4.0.6 (CVE-2026-40973)
- Jackson 2.x/OTel BOM imports added ahead of the local Spring Boot 4
  BOMs so module resolution does not downgrade the fixed versions

CVE-2026-40973 remains on spring-boot 3.4.13: no fix exists on the
OSS-EOL 3.4.x line; accepted and ignored in FOSSA.

Signed-off-by: Javier Aliaga <javier@diagrid.io>
@javier-aliaga
javier-aliaga requested review from a team as code owners July 17, 2026 15:33
@codecov

codecov Bot commented Jul 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.04%. Comparing base (fb9dded) to head (9eb2e84).

Additional details and impacted files
@@                Coverage Diff                 @@
##             release-1.17    #1789      +/-   ##
==================================================
+ Coverage           73.02%   73.04%   +0.01%     
+ Complexity           2285     2284       -1     
==================================================
  Files                 244      244              
  Lines                7463     7463              
  Branches              747      747              
==================================================
+ Hits                 5450     5451       +1     
+ Misses               1652     1650       -2     
- Partials              361      362       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@siri-varma siri-varma left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@siri-varma
siri-varma merged commit 9cac5e7 into dapr:release-1.17 Jul 17, 2026
15 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants