Skip to content

Commit bb34b4a

Browse files
david-leifkercursoragent
david-leifker
and
cursoragent
committed
fix(deps): bump httpclient5 to 5.6.1 for CVE-2026-40542 (#17323)
Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 29a7c67 commit bb34b4a

46 files changed

Lines changed: 139 additions & 140 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎build.gradle‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ buildscript {
6868
ext.micrometerVersion = '1.15.1'
6969
ext.vertxVersion = '4.5.24' // CVE-2026-1002 (e.g. from fabric8 kubernetes-httpclient-vertx)
7070
ext.nettyVersion = '4.1.132.Final' // align all io.netty modules; CVE-2026-33870
71+
// CVE-2026-40542 / GHSA: SCRAM-SHA-256 authentication verification (httpclient5 5.6 → 5.6.1+)
72+
ext.httpClient5Version = '5.6.1'
7173
// Align org.bouncycastle *-jdk18on (bcpkix, bcprov, bcutil); CVE-2026-0636 (bcprov fixed in 1.84+)
7274
ext.bouncyCastleJdk18onVersion = '1.84'
7375
// gRPC line version (grpc-netty-shaded bundles its own Netty; inspect META-INF/io.grpc.netty.shaded.io.netty.versions.properties in that jar).
@@ -191,7 +193,7 @@ project.ext.externalDependency = [
191193
'hibernateCore': 'org.hibernate:hibernate-core:5.2.16.Final',
192194
// CVE-2025-35036 / GHSA-7v6m-28jr-rg84 (EL in constraint violation messages); Play java-forms pulls 6.1.x otherwise
193195
'hibernateValidator': 'org.hibernate.validator:hibernate-validator:6.2.5.Final',
194-
'httpClient': 'org.apache.httpcomponents.client5:httpclient5:5.4.3',
196+
'httpClient': 'org.apache.httpcomponents.client5:httpclient5:' + httpClient5Version,
195197
'iStackCommons': 'com.sun.istack:istack-commons-runtime:4.0.1',
196198
// The jacksonBom controls the version of other jackson modules; pin the version once.
197199
// implementation enforcedPlatform(externalDependency.jacksonBom)
@@ -694,6 +696,7 @@ subprojects {
694696
implementation("com.fasterxml.jackson.core:jackson-databind:$jacksonVersion")
695697
implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:$jacksonVersion")
696698
implementation('com.squareup.okhttp3:okhttp:4.12.0')
699+
implementation("org.apache.httpcomponents.client5:httpclient5:${rootProject.ext.httpClient5Version}") // CVE-2026-40542
697700
implementation(externalDependency.commonsIo)
698701
implementation(externalDependency.protobuf)
699702
implementation(externalDependency.xercesImpl) // Xerces CVEs (2 high, 1 medium)

‎datahub-frontend/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -318,9 +318,9 @@ org.apache.commons:commons-compress:1.27.1=compileClasspath,runtimeClasspath,tes
318318
org.apache.commons:commons-exec:1.3=testCompileClasspath,testRuntimeClasspath
319319
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
320320
org.apache.commons:commons-text:1.15.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
321-
org.apache.httpcomponents.client5:httpclient5:5.4.3=runtimeClasspath,testRuntimeClasspath
322-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=runtimeClasspath,testRuntimeClasspath
323-
org.apache.httpcomponents.core5:httpcore5:5.3.4=runtimeClasspath,testRuntimeClasspath
321+
org.apache.httpcomponents.client5:httpclient5:5.6.1=runtimeClasspath,testRuntimeClasspath
322+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=runtimeClasspath,testRuntimeClasspath
323+
org.apache.httpcomponents.core5:httpcore5:5.4=runtimeClasspath,testRuntimeClasspath
324324
org.apache.httpcomponents:httpasyncclient:4.1.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
325325
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
326326
org.apache.httpcomponents:httpcore-nio:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

‎datahub-graphql-core/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -276,9 +276,9 @@ org.apache.commons:commons-compress:1.27.1=compileClasspath,runtimeClasspath,tes
276276
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
277277
org.apache.commons:commons-text:1.10.0=compileClasspath,testCompileClasspath
278278
org.apache.commons:commons-text:1.14.0=runtimeClasspath,testRuntimeClasspath
279-
org.apache.httpcomponents.client5:httpclient5:5.4.3=runtimeClasspath,testRuntimeClasspath
280-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=runtimeClasspath,testRuntimeClasspath
281-
org.apache.httpcomponents.core5:httpcore5:5.3.4=runtimeClasspath,testRuntimeClasspath
279+
org.apache.httpcomponents.client5:httpclient5:5.6.1=runtimeClasspath,testRuntimeClasspath
280+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=runtimeClasspath,testRuntimeClasspath
281+
org.apache.httpcomponents.core5:httpcore5:5.4=runtimeClasspath,testRuntimeClasspath
282282
org.apache.httpcomponents:httpasyncclient:4.1.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
283283
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
284284
org.apache.httpcomponents:httpcore-nio:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

‎datahub-upgrade/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -395,9 +395,9 @@ org.apache.hadoop:hadoop-mapreduce-client-jobclient:3.4.1=compileClasspath,produ
395395
org.apache.hadoop:hadoop-yarn-api:3.4.1=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
396396
org.apache.hadoop:hadoop-yarn-client:3.4.1=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
397397
org.apache.hadoop:hadoop-yarn-common:3.4.1=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
398-
org.apache.httpcomponents.client5:httpclient5:5.4.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
399-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
400-
org.apache.httpcomponents.core5:httpcore5:5.3.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
398+
org.apache.httpcomponents.client5:httpclient5:5.6.1=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
399+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
400+
org.apache.httpcomponents.core5:httpcore5:5.4=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
401401
org.apache.httpcomponents:httpasyncclient:4.1.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
402402
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
403403
org.apache.httpcomponents:httpcore-nio:4.4.16=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

‎entity-registry/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -223,9 +223,9 @@ org.apache.avro:avro:1.9.2=pegasusPlugin
223223
org.apache.commons:commons-compress:1.27.1=pegasusPlugin,restClient,restClientCompile,testCompileClasspath,testRestClient,testRuntimeClasspath
224224
org.apache.commons:commons-lang3:3.18.0=compileClasspath,dataModel,dataTemplate,dataTemplateCompile,pegasusPlugin,restClient,restClientCompile,runtimeClasspath,testCompileClasspath,testDataModel,testDataTemplate,testFixturesCompileClasspath,testFixturesRuntimeClasspath,testRestClient,testRuntimeClasspath
225225
org.apache.commons:commons-text:1.10.0=compileClasspath,dataModel,dataTemplate,dataTemplateCompile,pegasusPlugin,restClient,restClientCompile,runtimeClasspath,testCompileClasspath,testDataModel,testDataTemplate,testFixturesCompileClasspath,testFixturesRuntimeClasspath,testRestClient,testRuntimeClasspath
226-
org.apache.httpcomponents.client5:httpclient5:5.4.3=testRuntimeClasspath
227-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=testRuntimeClasspath
228-
org.apache.httpcomponents.core5:httpcore5:5.3.4=testRuntimeClasspath
226+
org.apache.httpcomponents.client5:httpclient5:5.6.1=testRuntimeClasspath
227+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=testRuntimeClasspath
228+
org.apache.httpcomponents.core5:httpcore5:5.4=testRuntimeClasspath
229229
org.apache.httpcomponents:httpasyncclient:4.1.5=testCompileClasspath,testRuntimeClasspath
230230
org.apache.httpcomponents:httpclient:4.3.1=pegasusPlugin,restClient,restClientCompile,testRestClient
231231
org.apache.httpcomponents:httpclient:4.5.14=testCompileClasspath,testRuntimeClasspath

‎ingestion-scheduler/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -274,9 +274,9 @@ org.apache.commons:commons-compress:1.27.1=compileClasspath,runtimeClasspath,tes
274274
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
275275
org.apache.commons:commons-text:1.10.0=compileClasspath,testCompileClasspath
276276
org.apache.commons:commons-text:1.14.0=runtimeClasspath,testRuntimeClasspath
277-
org.apache.httpcomponents.client5:httpclient5:5.4.3=runtimeClasspath,testRuntimeClasspath
278-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=runtimeClasspath,testRuntimeClasspath
279-
org.apache.httpcomponents.core5:httpcore5:5.3.4=runtimeClasspath,testRuntimeClasspath
277+
org.apache.httpcomponents.client5:httpclient5:5.6.1=runtimeClasspath,testRuntimeClasspath
278+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=runtimeClasspath,testRuntimeClasspath
279+
org.apache.httpcomponents.core5:httpcore5:5.4=runtimeClasspath,testRuntimeClasspath
280280
org.apache.httpcomponents:httpasyncclient:4.1.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
281281
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
282282
org.apache.httpcomponents:httpcore-nio:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

‎metadata-auth/auth-api/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,9 @@ org.apache.commons:commons-collections4:4.5.0=testCompileClasspath,testRuntimeCl
209209
org.apache.commons:commons-compress:1.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
210210
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
211211
org.apache.commons:commons-text:1.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
212-
org.apache.httpcomponents.client5:httpclient5:5.4.3=runtimeClasspath,testRuntimeClasspath
213-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=runtimeClasspath,testRuntimeClasspath
214-
org.apache.httpcomponents.core5:httpcore5:5.3.4=runtimeClasspath,testRuntimeClasspath
212+
org.apache.httpcomponents.client5:httpclient5:5.6.1=runtimeClasspath,testRuntimeClasspath
213+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=runtimeClasspath,testRuntimeClasspath
214+
org.apache.httpcomponents.core5:httpcore5:5.4=runtimeClasspath,testRuntimeClasspath
215215
org.apache.httpcomponents:httpasyncclient:4.1.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
216216
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
217217
org.apache.httpcomponents:httpcore-nio:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

‎metadata-dao-impl/kafka-producer/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -272,9 +272,9 @@ org.apache.commons:commons-compress:1.27.1=compileClasspath,runtimeClasspath,tes
272272
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
273273
org.apache.commons:commons-text:1.10.0=compileClasspath,testCompileClasspath
274274
org.apache.commons:commons-text:1.14.0=runtimeClasspath,testRuntimeClasspath
275-
org.apache.httpcomponents.client5:httpclient5:5.4.3=runtimeClasspath,testRuntimeClasspath
276-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=runtimeClasspath,testRuntimeClasspath
277-
org.apache.httpcomponents.core5:httpcore5:5.3.4=runtimeClasspath,testRuntimeClasspath
275+
org.apache.httpcomponents.client5:httpclient5:5.6.1=runtimeClasspath,testRuntimeClasspath
276+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=runtimeClasspath,testRuntimeClasspath
277+
org.apache.httpcomponents.core5:httpcore5:5.4=runtimeClasspath,testRuntimeClasspath
278278
org.apache.httpcomponents:httpasyncclient:4.1.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
279279
org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
280280
org.apache.httpcomponents:httpcore-nio:4.4.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

‎metadata-integration/java/acryl-spark-lineage/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -212,9 +212,9 @@ org.apache.hive:hive-serde:2.3.9=compileClasspath,provided,runtimeClasspath,test
212212
org.apache.hive:hive-shims:2.3.9=compileClasspath,provided,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
213213
org.apache.hive:hive-storage-api:2.7.2=compileClasspath,provided,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
214214
org.apache.hive:hive-vector-code-gen:2.3.9=compileClasspath,provided,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
215-
org.apache.httpcomponents.client5:httpclient5:5.4.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
216-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
217-
org.apache.httpcomponents.core5:httpcore5:5.3.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
215+
org.apache.httpcomponents.client5:httpclient5:5.6.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
216+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
217+
org.apache.httpcomponents.core5:httpcore5:5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
218218
org.apache.httpcomponents:httpclient:4.5.13=compileClasspath,provided,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
219219
org.apache.httpcomponents:httpcore:4.4.13=compileClasspath,provided,testCompileClasspath
220220
org.apache.httpcomponents:httpcore:4.4.16=runtimeClasspath,testRuntimeClasspath

‎metadata-integration/java/datahub-client/gradle.lockfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,9 +108,9 @@ org.apache.avro:avro:1.11.5=compileClasspath,runtimeClasspath,testCompileClasspa
108108
org.apache.commons:commons-compress:1.27.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
109109
org.apache.commons:commons-lang3:3.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
110110
org.apache.commons:commons-text:1.10.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
111-
org.apache.httpcomponents.client5:httpclient5:5.4.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
112-
org.apache.httpcomponents.core5:httpcore5-h2:5.3.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
113-
org.apache.httpcomponents.core5:httpcore5:5.3.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
111+
org.apache.httpcomponents.client5:httpclient5:5.6.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
112+
org.apache.httpcomponents.core5:httpcore5-h2:5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
113+
org.apache.httpcomponents.core5:httpcore5:5.4=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
114114
org.apache.httpcomponents:httpclient:4.5.13=runtimeClasspath,testRuntimeClasspath
115115
org.apache.httpcomponents:httpclient:4.5.2=testCompileClasspath
116116
org.apache.httpcomponents:httpcore:4.4.16=runtimeClasspath,testRuntimeClasspath

0 commit comments

Comments
 (0)