From d04442b5678287f8da9065f45dbe0c1afef7e641 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Wed, 28 Oct 2026 08:48:23 -0400 Subject: [PATCH] GEODE-10687: Upgrade ASM to 9.11 --- .../geode/gradle/plugins/DependencyConstraints.groovy | 6 ++++++ .../src/integrationTest/resources/assembly_content.txt | 6 +++--- .../integrationTest/resources/gfsh_dependency_classpath.txt | 6 +++--- .../src/integrationTest/resources/dependency_classpath.txt | 6 +++--- 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index a9ec580cae7..b9937f3d651 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -55,6 +55,8 @@ class DependencyConstraints { deps.put("bouncycastle.version", "1.86") // GEODE-10681: Pin hibernate-validator to a fixed version deps.put("hibernate-validator.version", "8.0.6.Final") + // GEODE-10687: Pin ASM (transitive via Jetty) to a fixed version + deps.put("asm.version", "9.11") deps.put("slf4j-api.version", "2.0.18") deps.put("jakarta.transaction-api.version", "2.0.1") deps.put("jboss-modules.version", "1.11.0.Final") @@ -204,6 +206,10 @@ class DependencyConstraints { api(group: 'org.bouncycastle', name: 'bcpkix-jdk18on', version: get('bouncycastle.version')) // GEODE-10681: Pin hibernate-validator to a fixed version api(group: 'org.hibernate.validator', name: 'hibernate-validator', version: get('hibernate-validator.version')) + // GEODE-10687: Pin ASM (transitive via Jetty) to a fixed version + api(group: 'org.ow2.asm', name: 'asm', version: get('asm.version')) + api(group: 'org.ow2.asm', name: 'asm-commons', version: get('asm.version')) + api(group: 'org.ow2.asm', name: 'asm-tree', version: get('asm.version')) api(group: 'org.assertj', name: 'assertj-core', version: '3.22.0') api(group: 'org.awaitility', name: 'awaitility', version: '4.2.0') api(group: 'org.buildobjects', name: 'jproc', version: '2.8.0') diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 3992fb39248..77ad048d028 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -922,9 +922,9 @@ lib/ST4-4.3.3.jar lib/angus-activation-2.0.0.jar lib/antlr-2.7.7.jar lib/antlr-runtime-3.5.2.jar -lib/asm-9.10.1.jar -lib/asm-commons-9.10.1.jar -lib/asm-tree-9.10.1.jar +lib/asm-9.11.jar +lib/asm-commons-9.11.jar +lib/asm-tree-9.11.jar lib/bcprov-jdk18on-1.86.jar lib/classgraph-4.8.147.jar lib/classmate-1.5.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 6dfda4950ac..3e400eeaa33 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -133,9 +133,9 @@ jline-terminal-jni-3.30.17.jar jline-terminal-ffm-3.30.17.jar ST4-4.3.3.jar txw2-4.0.2.jar -asm-commons-9.10.1.jar -asm-tree-9.10.1.jar -asm-9.10.1.jar +asm-commons-9.11.jar +asm-tree-9.11.jar +asm-9.11.jar reactive-streams-1.0.4.jar jline-native-3.30.17.jar antlr-runtime-3.5.2.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index eb9a5d882c9..67c4f949a39 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -123,9 +123,9 @@ jspecify-1.0.1.jar LatencyUtils-2.0.3.jar snakeyaml-2.5.jar spring-jcl-6.1.21.jar -asm-commons-9.10.1.jar -asm-tree-9.10.1.jar -asm-9.10.1.jar +asm-commons-9.11.jar +asm-tree-9.11.jar +asm-9.11.jar txw2-4.0.2.jar reactor-core-3.8.7.jar jline-console-3.30.17.jar