From 0c58ddf3deede518e5bb5b5a330ea481dd2eb38b Mon Sep 17 00:00:00 2001 From: Yicong Huang <17627829+Yicong-Huang@users.noreply.github.com> Date: Fri, 10 Jul 2026 12:10:52 -0700 Subject: [PATCH] fix(deps): upgrade bouncycastle to fix CVE-2025-14813 (#6286) Backport of #6286 to release/v1.2. Pins the Bouncy Castle JDK 18 artifacts to 1.84 via shared sbt dependencyOverrides (bcpkix/bcprov/bcutil-jdk18on), and updates computing-unit-managing-service/LICENSE-binary to match the resolved bundled jar versions. Adapted to the v1.2 build.sbt structure: v1.2 has no commonModuleSettings aggregate, so the overrides are appended to asfLicensingSettings and asfLicensingSettingsWithVendored, which every module applies. Related security report: https://github.com/apache/texera/security/dependabot/782 Verified with: JAVA_HOME=$(/usr/libexec/java_home -v 17) sbt 'show ComputingUnitManagingService / dependencyOverrides' 'show ComputingUnitManagingService / update' All three artifacts resolve to 1.84. Co-Authored-By: Claude Opus 4.8 (1M context) --- build.sbt | 16 ++++++++++++++-- computing-unit-managing-service/LICENSE-binary | 6 +++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/build.sbt b/build.sbt index 44c3d8ac1c3..67b838a2a0c 100644 --- a/build.sbt +++ b/build.sbt @@ -57,8 +57,20 @@ lazy val universalJvmFlagsSettings = Seq( // See project/AddMetaInfLicenseFiles.scala. // Dist-producing modules additionally override Universal / mappings in their own // build.sbt (not here) — see AddMetaInfLicenseFiles.distMappings. -lazy val asfLicensingSettings = AddMetaInfLicenseFiles.defaultSettings ++ coverageReportSettings ++ universalJvmFlagsSettings -lazy val asfLicensingSettingsWithVendored = AddMetaInfLicenseFiles.workflowOperatorSettings ++ coverageReportSettings ++ universalJvmFlagsSettings +val bouncyCastleVersion = "1.84" + +lazy val bouncyCastleOverrides = Seq( + "org.bouncycastle" % "bcpkix-jdk18on" % bouncyCastleVersion, + "org.bouncycastle" % "bcprov-jdk18on" % bouncyCastleVersion, + "org.bouncycastle" % "bcutil-jdk18on" % bouncyCastleVersion +) + +lazy val commonDependencyOverrides = Seq( + dependencyOverrides ++= bouncyCastleOverrides +) + +lazy val asfLicensingSettings = AddMetaInfLicenseFiles.defaultSettings ++ coverageReportSettings ++ universalJvmFlagsSettings ++ commonDependencyOverrides +lazy val asfLicensingSettingsWithVendored = AddMetaInfLicenseFiles.workflowOperatorSettings ++ coverageReportSettings ++ universalJvmFlagsSettings ++ commonDependencyOverrides val jacksonVersion = "2.18.8" diff --git a/computing-unit-managing-service/LICENSE-binary b/computing-unit-managing-service/LICENSE-binary index e60e32714ef..e9149cfadf2 100644 --- a/computing-unit-managing-service/LICENSE-binary +++ b/computing-unit-managing-service/LICENSE-binary @@ -530,9 +530,9 @@ Source files derived from third-party MIT-licensed projects: Scala/Java jars: - net.sourceforge.argparse4j.argparse4j-0.9.0.jar - - org.bouncycastle.bcpkix-jdk18on-1.78.1.jar - - org.bouncycastle.bcprov-jdk18on-1.82.jar - - org.bouncycastle.bcutil-jdk18on-1.78.1.jar + - org.bouncycastle.bcpkix-jdk18on-1.84.jar + - org.bouncycastle.bcprov-jdk18on-1.84.jar + - org.bouncycastle.bcutil-jdk18on-1.84.jar - org.checkerframework.checker-qual-3.52.0.jar - org.codehaus.mojo.animal-sniffer-annotations-1.26.jar - org.projectlombok.lombok-1.18.24.jar