From eb71560d9d46b42e7ab6f1ffb77d3bc10d9a1158 Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:30:30 -0400 Subject: [PATCH 01/14] Bump aquasecurity/trivy-action to 0.35.0, pinned by commit SHA (CVE-2026-33634) The 0.34.0 tag was removed upstream after the trivy-action supply-chain advisory (GHSA-69fq-xp46-6x23), so the weekly Docker scan workflow has been failing to resolve the action since. 0.35.0 is the first patched release; all existing 'with:' inputs are unchanged. Pinned to the immutable commit SHA (with version comment) rather than a tag, since tags can be re-pointed if the action repo is compromised -- the attack class behind this advisory. Matches the pinning convention adopted in legend-shared. --- .github/workflows/docker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 5a1e1af3cf1..4af2eb67140 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -46,7 +46,7 @@ jobs: # NOTE: if this gets more complicated, consider having this as a bash script run: mkdir -p ./${{ matrix.module.parent }}/${{ matrix.module.name }}/target && touch ./${{ matrix.module.parent }}/${{ matrix.module.name }}/target/${{ matrix.module.name }}-dummy.jar && docker build --quiet --tag local/${{ matrix.module.name }}:${{ github.sha }} ./${{ matrix.module.parent }}/${{ matrix.module.name }} - name: Scan image for security issues - uses: aquasecurity/trivy-action@0.34.0 + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 with: # TODO: we should probably also setup misconfiguration scanning # See https://github.com/aquasecurity/trivy-action#using-trivy-to-scan-infrastucture-as-code From 4ceb55cb4cfe2882f012a35116d4f2a35481051a Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:30:45 -0400 Subject: [PATCH 02/14] Bump redshift-jdbc42 2.0.0.3 -> 2.2.2 (CVE-2026-8178, CVE-2024-32888, CVE-2022-41828) Clears two critical alerts (RCE via unsafe class loading, SQL injection via line comment generation) and one high (remote command execution). Pure runtime-scope JDBC driver: no engine code compiles against com.amazon.redshift classes. Note Redshift has no PCT module or CI coverage; validated by full build + convergence only. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index e50c41e37a4..5a11e039427 100644 --- a/pom.xml +++ b/pom.xml @@ -156,7 +156,7 @@ 2.1.214 3.0.6 42.7.4 - 2.0.0.3 + 2.2.2 3.13.5 1.3.0.0 0.9.6 From 22c35646534fe0dce5b0fa7e8c756bfb3ddf6dc8 Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:30:45 -0400 Subject: [PATCH 03/14] Bump postgresql driver 42.7.4 -> 42.7.11 (CVE-2026-42198, CVE-2025-49146) Clears SCRAM authentication CPU-exhaustion DoS and channelBinding fallback issues. Runtime-scope driver; exercised by postgres PCT/SDT (testcontainers) in default CI. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 5a11e039427..2b131ee7fa0 100644 --- a/pom.xml +++ b/pom.xml @@ -155,7 +155,7 @@ 7.0.2 2.1.214 3.0.6 - 42.7.4 + 42.7.11 2.2.2 3.13.5 1.3.0.0 From 8a0e9fc4b5801bc5d1bd1863f03fd49568c43aaa Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:30:45 -0400 Subject: [PATCH 04/14] Bump logback 1.2.3 -> 1.2.13 (CVE-2023-6378, CVE-2021-42550) Clears the logback serialization vulnerabilities. Stays on the 1.2.x line: logback 1.3+ requires SLF4J 2.x and breaks logback-contrib 0.1.5, both incompatible with the current enforcer SLF4J allowlist. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 2b131ee7fa0..123570c60d2 100644 --- a/pom.xml +++ b/pom.xml @@ -207,7 +207,7 @@ 4.13.1 1.2.19 0.1.5 - 1.2.3 + 1.2.13 8.5.5 4.4.0 5.2.0 From cc92d79d8dc8999d4f59973b15f4968898c28b4d Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:02 -0400 Subject: [PATCH 05/14] Bump jetty 9.4.44.v20210927 -> 9.4.57.v20241219 (CVE-2024-13009 and 4 medium CVEs) Clears the GzipHandler request-body smuggling issue plus CVE-2024-9823, CVE-2024-8184, CVE-2023-40167 and CVE-2023-26048. Same 9.4 line, API compatible. Also removes a hardcoded jetty-util 9.4.44 version in legend-engine-xt-sql-postgres-server that shadowed the managed version and failed dependency convergence. Note: CVE-2026-2332 has no fix in the EOL 9.4 line and requires a Dropwizard/Jetty platform migration, tracked separately. --- .../legend-engine-xt-sql-postgres-server/pom.xml | 1 - pom.xml | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/legend-engine-xts-sql/legend-engine-xt-sql-postgres-server/pom.xml b/legend-engine-xts-sql/legend-engine-xt-sql-postgres-server/pom.xml index 2c742fc89fa..f3e0c475768 100644 --- a/legend-engine-xts-sql/legend-engine-xt-sql-postgres-server/pom.xml +++ b/legend-engine-xts-sql/legend-engine-xt-sql-postgres-server/pom.xml @@ -293,7 +293,6 @@ org.eclipse.jetty jetty-util - 9.4.44.v20210927 io.prometheus diff --git a/pom.xml b/pom.xml index 123570c60d2..6858c25e1c5 100644 --- a/pom.xml +++ b/pom.xml @@ -199,7 +199,7 @@ 3.1.0 2.0.1 2.25.1 - 9.4.44.v20210927 + 9.4.57.v20241219 2.10.14 2.4.7 2.17.0 From 81ccdb0a6be4e1cb975291c55ec394d0b5848688 Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:02 -0400 Subject: [PATCH 06/14] Bump json-smart 2.4.7 -> 2.5.2 (CVE-2023-1370) Transitive pin only; no engine code imports net.minidev. 2.5.2 matches the version adopted in legend-shared-bom. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 6858c25e1c5..8f0ec74170a 100644 --- a/pom.xml +++ b/pom.xml @@ -201,7 +201,7 @@ 2.25.1 9.4.57.v20241219 2.10.14 - 2.4.7 + 2.5.2 2.17.0 5.11.0 4.13.1 From 556fc6091b8577a43a84ce4dd76a73fc0494483d Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:03 -0400 Subject: [PATCH 07/14] Bump protobuf-java 3.25.3 -> 3.25.5 (CVE-2024-7254) Patch bump clearing the nested-message stack-overflow DoS. Consumed transitively (grpc/cloud drivers); no direct engine usage. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 8f0ec74170a..bb2d0400796 100644 --- a/pom.xml +++ b/pom.xml @@ -219,7 +219,7 @@ 4.0.0 4.5.8 0.8.1 - 3.25.3 + 3.25.5 1.7.36 1.33 1.5.20 From c4a1aaf5c23a885cfe27195b3d530f6b386dee0d Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:03 -0400 Subject: [PATCH 08/14] Bump commons-io 2.7 -> 2.16.1 (CVE-2024-47554) Clears the XmlStreamReader DoS. Source and binary compatible; matches the version adopted in legend-pure. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index bb2d0400796..c3d0129a4da 100644 --- a/pom.xml +++ b/pom.xml @@ -170,7 +170,7 @@ 1.15 1.21 1.5 - 2.7 + 2.16.1 3.18.0 1.10.0 0.40.7 From 0ec6f800471bc4a8dbd402fdebbc9984ec7923ff Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:03 -0400 Subject: [PATCH 09/14] Bump classgraph 4.8.25 -> 4.8.184 (CVE-2021-47621) Clears the XXE issue. Two consumers (EngineJavaCompiler and a changetoken test base); module tests pass. Matches the version adopted in legend-pure. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index c3d0129a4da..387d9315fc2 100644 --- a/pom.xml +++ b/pom.xml @@ -181,7 +181,7 @@ 10.2.0 24.3.25 2.3.34 - 4.8.25 + 4.8.184 2.21.0 1.65.1 33.4.6-jre From 73e7adf24ffe421e2a57edc78e62379a1e429461 Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:27 -0400 Subject: [PATCH 10/14] Bump minio 8.5.5 -> 8.6.0 (CVE-2025-59952) Clears the XML tag value substitution vulnerability. minio 8.6 moved to okhttp 5.x, whose 'okhttp' Maven artifact is an empty Kotlin multiplatform shim (Maven cannot follow Gradle module metadata to the real jar), breaking compilation of the sole minio consumer, legend-engine-xt-iceberg-test-support. Added a managed okhttp-jvm dependency carrying the actual classes, with the same org.jetbrains exclusion as minio for dependency convergence, and a dependency-analyzer ignore since the compile-time need (builder overload resolution) leaves no bytecode reference. --- .../pom.xml | 27 +++++++++++++++++++ pom.xml | 16 ++++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/legend-engine-xts-iceberg/legend-engine-xt-iceberg-test-support/pom.xml b/legend-engine-xts-iceberg/legend-engine-xt-iceberg-test-support/pom.xml index c611f2cf8e3..6eaf1183488 100644 --- a/legend-engine-xts-iceberg/legend-engine-xt-iceberg-test-support/pom.xml +++ b/legend-engine-xts-iceberg/legend-engine-xt-iceberg-test-support/pom.xml @@ -124,6 +124,11 @@ minio + + com.squareup.okhttp3 + okhttp-jvm + + org.slf4j jcl-over-slf4j @@ -131,4 +136,26 @@ + + + + + org.apache.maven.plugins + maven-dependency-plugin + + + dependency-analyze + + + + com.squareup.okhttp3:okhttp-jvm + + + + + + + diff --git a/pom.xml b/pom.xml index 387d9315fc2..d867c69c755 100644 --- a/pom.xml +++ b/pom.xml @@ -208,7 +208,7 @@ 1.2.19 0.1.5 1.2.13 - 8.5.5 + 8.6.0 4.4.0 5.2.0 5.3.1 @@ -4185,6 +4185,20 @@ + + + com.squareup.okhttp3 + okhttp-jvm + 5.1.0 + + + org.jetbrains + * + + + From e6c95e93b530a5152258dc5ebb4316256e5593ef Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 14:31:27 -0400 Subject: [PATCH 11/14] Bump checkstyle 8.25 -> 8.29 (CVE-2019-10782) Build-time only dependency of maven-checkstyle-plugin. Checkstyle 8.26+ hardcodes a new CustomImportOrder violation for blank lines within an import group, which flagged 13 pre-existing sites; added the same SuppressionSingleFilter to checkstyle.xml as legend-pure to retain pre-8.26 behavior. --- checkstyle.xml | 10 ++++++++++ pom.xml | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/checkstyle.xml b/checkstyle.xml index dbfc857956f..0bc1575a72d 100644 --- a/checkstyle.xml +++ b/checkstyle.xml @@ -36,6 +36,16 @@ + + + + + + + diff --git a/pom.xml b/pom.xml index d867c69c755..a1fefeb131a 100644 --- a/pom.xml +++ b/pom.xml @@ -243,7 +243,7 @@ 3.1.2 3.3.1 3.6.0 - 8.25 + 8.29 3.2.0 3.4.1 3.2.0 From 9ee04da9bed8b0c6043476eff87967d967b3379a Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 21:26:21 -0400 Subject: [PATCH 12/14] Bump postgresql driver 42.7.11 -> 42.7.12 (CVE-2026-54291) Follow-up to the 42.7.11 bump: CVE-2026-54291 (medium) was published against <= 42.7.11 and flagged by the Mend scan on the PR; 42.7.12 is the first fixed release. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index a1fefeb131a..33946265557 100644 --- a/pom.xml +++ b/pom.xml @@ -155,7 +155,7 @@ 7.0.2 2.1.214 3.0.6 - 42.7.11 + 42.7.12 2.2.2 3.13.5 1.3.0.0 From cd9e5d532564dab701a92b6cd41384611cae21ea Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 21:26:39 -0400 Subject: [PATCH 13/14] Pin transitive bcprov-jdk18on to 1.84 (CVE-2026-5598, CVE-2025-14813, CVE-2026-0636) minio 8.6.0 pulls bcprov-jdk18on 1.81 transitively, which carries two critical and one medium CVE fixed in 1.84. Managed pin raises the resolved version; the engine's own direct BouncyCastle dependency is the separate legacy bcprov-jdk15on artifact and will be migrated to the -jdk18on line in its own change. --- pom.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pom.xml b/pom.xml index 33946265557..891bb45e0fc 100644 --- a/pom.xml +++ b/pom.xml @@ -4199,6 +4199,14 @@ + + + org.bouncycastle + bcprov-jdk18on + 1.84 + From 2b8f2191cf08e81c93fbcf4439c4dbd74bd8bdea Mon Sep 17 00:00:00 2001 From: Rafael Bey-Hernandez Date: Thu, 9 Jul 2026 21:26:39 -0400 Subject: [PATCH 14/14] Fix embedded Mongo server leak in application-query tests TestQueryStoreManager and TestDataCubeQueryStoreManager built their store from a field-initializer TestMongoClientProvider, then @Before replaced the provider field with a fresh instance the store never used, and @After cleaned only that unused instance. JUnit instantiates the test class per test method, so every test leaked the embedded Mongo server it was actually using -- 81 leaked servers per run, exhausting file descriptors on high-core machines (netty event-loop pools scale with core count) and failing with 'Too many open files'. Construct the store in @Before wired to the same provider that @After shuts down: one server per test, always cleaned. Suite runs ~10x faster (13s vs 133s). --- .../application/query/api/TestDataCubeQueryStoreManager.java | 5 +++-- .../engine/application/query/api/TestQueryStoreManager.java | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestDataCubeQueryStoreManager.java b/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestDataCubeQueryStoreManager.java index f16b5042610..9f55301ea6c 100644 --- a/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestDataCubeQueryStoreManager.java +++ b/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestDataCubeQueryStoreManager.java @@ -127,8 +127,8 @@ DataCubeQuery build() } } - private TestMongoClientProvider testMongoClientProvider = new TestMongoClientProvider(); - private final DataCubeQueryStoreManager store = new DataCubeQueryStoreManager(testMongoClientProvider.mongoClient); + private TestMongoClientProvider testMongoClientProvider; + private DataCubeQueryStoreManager store; private static final TestVaultImplementation testVaultImplementation = new TestVaultImplementation(); @BeforeClass @@ -150,6 +150,7 @@ public static void cleanUpClass() public void setup() { this.testMongoClientProvider = new TestMongoClientProvider(); + this.store = new DataCubeQueryStoreManager(this.testMongoClientProvider.mongoClient); } @After diff --git a/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestQueryStoreManager.java b/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestQueryStoreManager.java index df7233ab438..6f8c53132cd 100644 --- a/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestQueryStoreManager.java +++ b/legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestQueryStoreManager.java @@ -318,8 +318,8 @@ private static QueryParameterValue createTestParameterValue(String name, String return queryParameterValue; } - private TestMongoClientProvider testMongoClientProvider = new TestMongoClientProvider(); - private final QueryStoreManager store = new QueryStoreManager(testMongoClientProvider.mongoClient); + private TestMongoClientProvider testMongoClientProvider; + private QueryStoreManager store; private static final TestVaultImplementation testVaultImplementation = new TestVaultImplementation(); @BeforeClass @@ -341,6 +341,7 @@ public static void cleanUpClass() public void setup() { this.testMongoClientProvider = new TestMongoClientProvider(); + this.store = new QueryStoreManager(this.testMongoClientProvider.mongoClient); } @After