Repository navigation
[Backport release-1.19] fix: Upgrade dependencies with known CVEs - #1828
Merged
Merged
Conversation
* fix: Upgrade dependencies with known CVEs Jackson 2.21.7, Jackson 3 3.1.7, Netty 4.2.17.Final, Spring Boot 4.0.8, OpenTelemetry 1.62.0 and Tomcat 11.0.25. The OpenTelemetry and Jackson BOMs are imported before the Spring Boot BOM, including in the modules that import the Spring Boot 4 BOM locally, so they are not overridden. Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix: Manage OpenTelemetry in dapr-sdk-bom durabletask-client and dapr-sdk-workflows expose opentelemetry-api, and Spring Boot 4.0.8 manages OpenTelemetry 1.55.0. Import opentelemetry-bom 1.62.0 in dapr-sdk-bom so consumers that import it before the Spring Boot BOM get the patched version. Signed-off-by: Javier Aliaga <javier@diagrid.io> --------- Signed-off-by: Javier Aliaga <javier@diagrid.io> (cherry picked from commit b5c4d2f)
javier-aliaga
approved these changes
Oct 8, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-1.19 #1828 +/- ##
==================================================
+ Coverage 79.11% 79.15% +0.03%
Complexity 2604 2604
==================================================
Files 264 264
Lines 7785 7785
Branches 820 820
==================================================
+ Hits 6159 6162 +3
+ Misses 1266 1263 -3
Partials 360 360 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport b5c4d2f from #1821.