Repository navigation
fix(deps): bump dependencies to fix security alerts - #67
Merged
Merged
Conversation
- com.google.guava:guava 20.0 -> 33.7.2-jre (GHSA-5mg8-w23w-74h3, GHSA-7g45-4rm6-3mm3, GHSA-mvr2-9pj6-7w5j, GHSA-xxph-c9ww-hj94). - org.apache.logging.log4j 2.17.1 -> 2.25.5 (log4j-core GHSA-3pxv-7cmr-fjr4, GHSA-6hg6-v5c8-fphq, GHSA-h383-gmxw-35v2, GHSA-vc5p-v9hr-52mj; log4j-api GHSA-qv9r-c865-cp47). - org.yaml:snakeyaml 1.31 -> 2.0 (GHSA-9w3m-gqgf-c4p9, GHSA-mjmj-j48q-9wg2, GHSA-w37g-rhq8-7m4j). SnakeYAML 2 removed the no-options constructors, so the validator's loader passes LoaderOptions to Constructor and DumperOptions to Representer. All three keep Java 8 bytecode; CI builds and tests on JDK 8. GitHub Actions: docker/login-action 650006c (v4.2.0), docker/setup-qemu-action 0611638 (v4.1.0) and docker/setup-buildx-action d7f5e7f (v4.1.0) are no longer on the ASF allowlist; re-pin them to 81c6f93 (v4.7.0), 9901266 (v4.4.0) and f87e599 (v4.4.1). actions/checkout v2/v4 -> v7, actions/setup-java v4 -> v6, actions/cache v4 -> v6.
wu-sheng
changed the title
kezhenxu94
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump the mock collector's and validator's dependencies behind the open Dependabot alerts, and re-pin the docker actions the ASF allowlist no longer accepts.
Dependencies (
pom.xml, inherited bymock-collectorandvalidator)SnakeYAML 2 removed
new Constructor(Class)andnew Representer(), sovalidator/.../entity/Data.javanow passesnew LoaderOptions()andnew DumperOptions(). Loading behaves the same: the data files are plain mappings. 2.0 is the first release that fixes all three advisories. All three libraries still ship Java 8 bytecode (guava 33.7.2-jre adds org.jspecify:jspecify 1.0.1, an annotations jar).GitHub Actions
docker/login-action
650006c(v4.2.0) ->81c6f93(v4.7.0)docker/setup-qemu-action
0611638(v4.1.0) ->9901266(v4.4.0)docker/setup-buildx-action
d7f5e7f(v4.1.0) ->f87e599(v4.4.1)All three old SHAs are missing from apache/infrastructure-actions
approved_patterns.yml, so the image publish job would be refused.actions/checkout v2/v4 -> v7, actions/setup-java v4 -> v6 (
zulu, still offered), actions/cache v4 -> v6infra-e2e, License, changelog
Not used / not generated / no changelog file in this repository.
Verified locally (JDK 8, zulu)
./mvnw clean packagewith tests: pass, includingDataAssertTest, which loadsexpectedData.yamlandactualData.yamlthrough the changed loaderdependency:tree: guava 33.7.2-jre, log4j 2.25.5, snakeyaml 2.0make build.mock-collector)Left out on purpose