From 3f4bc6067cd47630f78c462d4148ab53afed7c3b Mon Sep 17 00:00:00 2001 From: Rundeck CI Date: Wed, 22 Jul 2026 13:14:38 -0700 Subject: [PATCH 1/2] [RUN-4678] Upgrade jgit/jgit-ssh-apache to 7.2.0 to drop transitive eddsa (CVE-2020-36843) Snyk (SNYK-JAVA-NETI2PCRYPTO-9402849) flags net.i2p.crypto:eddsa:0.3.0, pulled in transitively here via org.eclipse.jgit.ssh.apache:6.10.1's Apache MINA SSHD dependency. Unlike the sshj-based plugins, this is a real transitive dependency, not unused cruft. Upgrading org.eclipse.jgit and org.eclipse.jgit.ssh.apache to 7.2.0 (Snyk's suggested fix version) bumps the transitive sshd-osgi/sshd-sftp dependency from 2.14.0 to 2.15.0, which no longer depends on net.i2p.crypto:eddsa at all - confirmed via the resolved dependency tree. Full clean build and test suite pass unchanged (65 tests, no failures) with no source-level API breakage between jgit 6.10.1 and 7.2.0. --- gradle/libs.versions.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index ae2e48a..2f0f877 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -6,8 +6,8 @@ groovy = "4.0.32" junit = "4.13.2" rundeckCore = "6.1.0-SNAPSHOT" slf4j = "2.0.18" -jgit = "6.10.1.202505221210-r" -jgitSshApache = "6.10.1.202505221210-r" +jgit = "7.2.0.202503040940-r" +jgitSshApache = "7.2.0.202503040940-r" spock = "2.3-groovy-4.0" bytebuddy = "1.18.11" objenesis = "3.5" From 13d02bc8fe052bd26614fcc783b0246bd549d3f1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 22 Jul 2026 20:35:59 +0000 Subject: [PATCH 2/2] Remove outdated JGit vulnerability comment from build.gradle --- build.gradle | 1 - 1 file changed, 1 deletion(-) diff --git a/build.gradle b/build.gradle index cfd6d5e..354c42f 100644 --- a/build.gradle +++ b/build.gradle @@ -89,7 +89,6 @@ configurations.all { substitute module('commons-lang:commons-lang') using module("org.apache.commons:commons-lang3:${libs.versions.commonsLang3.get()}") } - // Note: JGit vulnerabilities left as-is to avoid code breaking changes } }