Repository navigation
Bump dependencies to fix security alerts - #14191
Merged
Merged
Conversation
Shipped OAP jars (dist-material/release-docs/LICENSE). Dependabot does not flag these because their versions come from a BOM import or a transitive dependency, so its dependency graph records them without a version. OSV lists them as vulnerable at the versions the LICENSE file names. - netty 4.2.15.Final -> 4.2.19.Final (root pom netty.version), with netty-tcnative-boringssl-static 2.0.77.Final -> 2.0.84.Final, the version netty 4.2.19.Final is built with. - lz4-java (at.yawk.lz4) 1.10.1 -> 1.11.4 and snappy-java 1.1.10.5 -> 1.1.10.12, both pulled in by kafka-clients 3.9.2, now managed in oap-server-bom. - dist-material/release-docs/LICENSE regenerated with the CI-pinned license-eye (5b7ee17); only these version lines change. e2e Go fixtures (not shipped): cases/go/service and cases/profiling/ebpf/network move golang.org/x/net 0.58.0 -> 0.62.0 and golang.org/x/crypto 0.55.0 -> 0.58.0 (with x/sys 0.49.0 and x/text 0.43.0). gRPC stays on 1.83.2. GitHub Actions: actions/checkout v4/v6 -> v7, actions/cache v4 -> v6, actions/upload-artifact v4 -> v7, actions/download-artifact v4 -> v8, actions/setup-java v4 -> v6, actions/setup-go v5 -> v7, github/codeql-action v3 -> v4, docker/login-action v4.6.0 -> v4.7.0 (ASF-approved SHA; v4.6.0 is deprecated on the ASF allowlist), and apache/skywalking-infra-e2e 68bbdec -> 56ac8be (current main).
wankai123
approved these changes
Nov 3, 2026
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump dependencies that carry known CVEs on the shipped OAP distribution, the e2e Go fixtures, and the GitHub Actions used by CI.
Dependencies
Shipped OAP jars (
dist-material/release-docs/LICENSE). Dependabot does not flag these because their versions come from a BOM import or a transitive dependency, so its dependency graph has no version for them. OSV lists them as vulnerable at the versions the LICENSE file names.pom.xml(netty.version)pom.xmloap-server-bom/pom.xml(new managed entry)oap-server-bom/pom.xml(new managed entry)e2e Go fixtures (not shipped):
test/e2e-v2/cases/go/service/go.modandtest/e2e-v2/cases/profiling/ebpf/network/go.modmove golang.org/x/net 0.58.0 -> 0.62.0 (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617, GO-2026-6860, GO-2026-6866) and golang.org/x/crypto 0.55.0 -> 0.58.0 (GO-2026-6354, GO-2026-6355), with x/sys 0.49.0 and x/text 0.43.0. gRPC stays on 1.83.2.GitHub Actions
name+pathinputs are used, so the v5 by-ID path change does not apply)temurin, not the removed Adopt distributions)dbcb813, expiring on the ASF allowlist) -> v4.7.0 (81c6f93, ASF-approved)infra-e2e
apache/skywalking-infra-e2e
68bbdec->56ac8be(current main, CI green) in all 5 e2e jobs.License
dist-material/release-docs/LICENSEwas regenerated with the CI-pinned license-eye (5b7ee17); only the version lines of the bumped jars change. CHANGES log updated.Verified locally
./mvnw flatten:flatten install -Dmaven.test.skip -Dcheckstyle.skip -Dgpg.skip -T 1Cwith JDK 11: pass (git-commit-id plugin skipped because the build ran in a git worktree). The dist tarball contains netty 4.2.19.Final, netty-tcnative 2.0.84.Final, lz4-java 1.11.4 and snappy-java 1.1.10.12.license-eye dependency resolve --summary ./dist-material/release-docs/LICENSE.tpl(5b7ee17), thengit diff: no change, so the committed LICENSE is reproducible.Left out on purpose
test/e2e-v2/java-test-service/**: the e2e test services run on Spring Boot 2.5.5 and are compiled for JDK 8 (the java-versions e2e leg runs them on old JDKs). OSV reports Spring Framework, Tomcat, Jackson, logback, snakeyaml and others there. The open-source Spring Boot 2.x line ends at 2.7.18, which still carries open CVEs, and Spring Boot 3 needs JDK 17, so this is a separate decision, not a bump.apm-protocol/apm-network/pom.xml: OSV reads this pom on its own and resolves guava 33.5.0-android and netty 4.1.130.Final through grpc. The OAP distribution ships guava 33.7.2-jre and netty 4.2.19.Final throughoap-server-bom, so nothing shipped is affected.The scheduled CI on master has failed every day since at least 2026-10-27 in a few e2e jobs (for example VM Prometheus, Alipay Mini Program Monitoring, eBPF Access Log ES Sharding); this PR does not try to fix those.
Update the
CHANGESlog.