From eadb920cdb3cc423069cf353381122b997ba2ee6 Mon Sep 17 00:00:00 2001
From: JinwooHwang <jinwoo@apache.org>
Date: Wed, 28 Oct 2026 08:48:23 -0400
Subject: [PATCH] GEODE-10687: Upgrade ASM to 9.11

---
 .../geode/gradle/plugins/DependencyConstraints.groovy       | 6 ++++++
 .../src/integrationTest/resources/assembly_content.txt      | 6 +++---
 .../integrationTest/resources/gfsh_dependency_classpath.txt | 6 +++---
 .../src/integrationTest/resources/dependency_classpath.txt  | 6 +++---
 4 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
index 97ce0f4081c..067eacfb75a 100644
--- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
+++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
@@ -55,6 +55,8 @@ class DependencyConstraints {
     deps.put("bouncycastle.version", "1.86")
     // GEODE-10681: Pin hibernate-validator to a fixed version
     deps.put("hibernate-validator.version", "8.0.6.Final")
+    // GEODE-10687: Pin ASM (transitive via Jetty) to a fixed version
+    deps.put("asm.version", "9.11")
     deps.put("slf4j-api.version", "2.0.18")
     deps.put("jakarta.transaction-api.version", "2.0.1")
     deps.put("jboss-modules.version", "1.11.0.Final")
@@ -201,6 +203,10 @@ class DependencyConstraints {
         api(group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: get('bouncycastle.version'))
         // GEODE-10681: Pin hibernate-validator to a fixed version
         api(group: 'org.hibernate.validator', name: 'hibernate-validator', version: get('hibernate-validator.version'))
+        // GEODE-10687: Pin ASM (transitive via Jetty) to a fixed version
+        api(group: 'org.ow2.asm', name: 'asm', version: get('asm.version'))
+        api(group: 'org.ow2.asm', name: 'asm-commons', version: get('asm.version'))
+        api(group: 'org.ow2.asm', name: 'asm-tree', version: get('asm.version'))
         api(group: 'org.assertj', name: 'assertj-core', version: '3.22.0')
         api(group: 'org.awaitility', name: 'awaitility', version: '4.2.0')
         api(group: 'org.buildobjects', name: 'jproc', version: '2.8.0')
diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt
index 34fe169fbad..662fd2b199f 100644
--- a/geode-assembly/src/integrationTest/resources/assembly_content.txt
+++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt
@@ -920,9 +920,9 @@ lib/ST4-4.3.3.jar
 lib/angus-activation-2.0.0.jar
 lib/antlr-2.7.7.jar
 lib/antlr-runtime-3.5.2.jar
-lib/asm-9.10.1.jar
-lib/asm-commons-9.10.1.jar
-lib/asm-tree-9.10.1.jar
+lib/asm-9.11.jar
+lib/asm-commons-9.11.jar
+lib/asm-tree-9.11.jar
 lib/bcprov-jdk18on-1.86.jar
 lib/classgraph-4.8.147.jar
 lib/classmate-1.5.1.jar
diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
index f0b2e98e1f7..4370bbedb0e 100644
--- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
+++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
@@ -133,9 +133,9 @@ snakeyaml-2.5.jar
 reactor-core-3.8.7.jar
 ST4-4.3.3.jar
 txw2-4.0.2.jar
-asm-commons-9.10.1.jar
-asm-tree-9.10.1.jar
-asm-9.10.1.jar
+asm-commons-9.11.jar
+asm-tree-9.11.jar
+asm-9.11.jar
 reactive-streams-1.0.4.jar
 antlr-runtime-3.5.2.jar
 tomcat-embed-el-10.1.42.jar
diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
index f003457a9a6..f5a74d9d0c6 100644
--- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
+++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
@@ -130,9 +130,9 @@ jspecify-1.0.1.jar
 LatencyUtils-2.0.3.jar
 snakeyaml-2.5.jar
 spring-jcl-6.1.21.jar
-asm-commons-9.10.1.jar
-asm-tree-9.10.1.jar
-asm-9.10.1.jar
+asm-commons-9.11.jar
+asm-tree-9.11.jar
+asm-9.11.jar
 txw2-4.0.2.jar
 reactor-core-3.8.7.jar
 ST4-4.3.3.jar