Repository navigation
fix/security: update Java image dependencies - #1050
Merged
Merged
Conversation
The image bundles vulnerable Guava and Tika versions through its build tools. Refresh Coursier, Maven and Gradle, apply available OS updates, and pin Guava 33.7.2-jre in the indexer and build-tool distributions. Build a standalone Coursier JVM launcher with Tika 3.2.2 while preserving the system trust store. Remove bootstrap and Gradle build caches before their image layers are created.
Collaborator
Author
|
This change is part of the following stack: Change managed by git-spice. |
chrapkowski-sg
marked this pull request as ready for review
October 29, 2026 13:08
Use the upstream Coursier JVM launcher and leave Maven and Gradle bundled dependencies unchanged instead of maintaining custom tool distributions. Keep the tool upgrades, application Guava constraint, OS updates, and unused Gradle build-cache cleanup. Remove the Guava JAR replacements and Gradle metadata rewrite. Remove the custom Coursier bootstrap and Tika override, retaining the runtime cache required by the upstream launcher and the system trust-store behavior. The Tika CVE remains a package finding, but its vulnerable XML parsing path is not reached by Coursier 2.1.26 archive detection. Source inspection and targeted checks against unpatched Tika 2.9.4 support that assessment; they do not establish image-wide safety or Guava exploitability.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates Maven, Gradle, Coursier, and Ubuntu packages in the Java image to pick up security fixes.
Guava comes in transitively, so a dependency constraint in
scip-sharedselects33.7.2-jrefor the indexer and compiler plugins.Also removes the unused Gradle build cache from the image and uses the downloaded Coursier JVM launcher directly, avoiding a redundant installation while preserving the system trust store.