[GEODE-10622] Remediation of CVE-2026-47857 (#8049)
diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
index a41e165..2b99bdb 100644
--- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
+++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
@@ -67,6 +67,9 @@
deps.put("springldap.version", "3.2.7")
deps.put("springdoc.version", "2.6.0")
+ // Pin Reactor Core (transitive via spring-shell-core) to a fixed version
+ deps.put("reactor-core.version", "3.8.7")
+
// These version numbers are used in testing various versions of tomcat and are consumed explicitly
// in will be called explicitly in the relevant extensions module, and respective configurations
// in geode-assembly.gradle. Moreover, dependencyManagement does not seem to play nicely when
@@ -149,6 +152,8 @@
api(group: 'io.github.resilience4j', name: 'resilience4j-retry', version: '1.7.1')
api(group: 'io.lettuce', name: 'lettuce-core', version: '6.1.8.RELEASE')
api(group: 'io.micrometer', name: 'micrometer-core', version: get('micrometer.version'))
+ // Pin Reactor Core (pulled in via spring-shell-core) to 3.8.7
+ api(group: 'io.projectreactor', name: 'reactor-core', version: get('reactor-core.version'))
api(group: 'io.swagger.core.v3', name: 'swagger-annotations', version: '2.2.22')
api(group: 'org.hdrhistogram', name: 'HdrHistogram', version: '2.2.2')
api(group: 'it.unimi.dsi', name: 'fastutil', version: get('fastutil.version'))
diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt
index 4fa1bd7..212afff 100644
--- a/geode-assembly/src/integrationTest/resources/assembly_content.txt
+++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt
@@ -1034,7 +1034,7 @@
lib/mx4j-tools-3.0.1.jar
lib/ra.jar
lib/reactive-streams-1.0.4.jar
-lib/reactor-core-3.6.10.jar
+lib/reactor-core-3.8.7.jar
lib/rmiio-2.1.2.jar
lib/shiro-cache-3.0.0.jar
lib/shiro-config-core-3.0.0.jar
diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
index 4f0a0b8..da3bae0 100644
--- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
+++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
@@ -123,7 +123,7 @@
jspecify-1.0.1.jar
LatencyUtils-2.0.3.jar
snakeyaml-2.5.jar
-reactor-core-3.6.10.jar
+reactor-core-3.8.7.jar
jline-console-3.26.3.jar
jline-builtins-3.26.3.jar
jline-reader-3.26.3.jar
diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
index c3ee193..f4125d3 100644
--- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
+++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
@@ -127,7 +127,7 @@
asm-tree-9.10.1.jar
asm-9.10.1.jar
txw2-4.0.2.jar
-reactor-core-3.6.10.jar
+reactor-core-3.8.7.jar
jline-console-3.26.3.jar
jline-builtins-3.26.3.jar
jline-reader-3.26.3.jar
