8000 Bump org.apache.geode:geode-core from 1.15.2 to 2.0.3 by dependabot[bot] · Pull Request #286 · DominiqueComte/cacheproviders · GitHub
[go: up one dir, main page]
Skip to content

Bump org.apache.geode:geode-core from 1.15.2 to 2.0.3 - #286

Merged
DominiqueComte merged 1 commit into
masterfrom
dependabot/maven/org.apache.geode-geode-core-2.0.3
Oct 25, 2026
Merged

Bump org.apache.geode:geode-core from 1.15.2 to 2.0.3#286
DominiqueComte merged 1 commit into
masterfrom
dependabot/maven/org.apache.geode-geode-core-2.0.3

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading
Copy link
Copy Markdown

Bumps org.apache.geode:geode-core from 1.15.2 to 2.0.3.

Release notes

Sourced from org.apache.geode:geode-core's releases.

Apache Geode 2.0.3

This maintenance release addresses security vulnerabilities across multiple dependencies, including Apache Shiro, Eclipse Jetty, Jackson, Micrometer, HttpCore5, Bouncy Castle, Reactor Core, and Log4j.

Highlights

  • Apache Shiro Major Upgrade: Remediated CVE-2026-49268 by upgrading Shiro from 2.1.0 to 3.0.0 across all modules (GEODE-10607 #8033, GEODE-10591 #8017)

  • Jetty Security Patches: Remediated CVE-2026-10050 by upgrading Jetty from 12.0.33 to 12.0.37 (GEODE-10605 #8031)

  • Jackson Security Patches: Remediated GHSA-2m67-wjpj-xhg9 and CVE-2026-19032 by upgrading Jackson from 2.21.2 to 2.21.6 (GEODE-10589 #8015, GEODE-10621 #8048)

  • Micrometer Security Patches: Remediated CVE-2026-40984 and CVE-2026-59296 by upgrading Micrometer from 1.14.0 to 1.16.7 (GEODE-10592 #8018, GEODE-10619 #8044)

  • HttpCore5 Remediation: Remediated CVE-2026-54428 by upgrading HttpCore5 and HttpCore5-H2 from 5.3.6 to 5.4.3 (GEODE-10590 #8016)

  • Bouncy Castle Remediation: Remediated CVE-2026-8763 in the bcprov-jdk18on transitive dependency, 1.84 to 1.85 (GEODE-10606 #8032)

  • Reactor Core Remediation: Remediated CVE-2026-47857 by pinning Reactor Core, a transitive dependency of spring-shell-core, from 3.6.10 to 3.8.7 (GEODE-10622 #8049)

  • Log4j Upgrade: Upgraded Log4j from 2.25.4 to 2.25.5 to address a reported advisory (GEODE-10604 #8030)

sha256 for apache-geode-2.0.3.tgz is 23dd1cbf5c6ed49909a596f0b49c0ec73f6f3c7e6fec20c07d32af3543684825

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-2.0.3

Apache Geode 2.0.2

This maintenance release addresses security vulnerabilities across multiple dependencies, including Log4j, Jackson, and Bouncy Castle, and HttpCore5.

Highlights

  • Log Injection Remediation: Remediated CVE-2026-34478 - Improper Output Neutralization for Logs in Log4j Rfc5424Layout via CRLF injection (GEODE-10579 #8005)

  • Denial of Service Remediation: Fixed Allocation of Resources Without Limits or Throttling in Jackson Core allowing oversized JSON documents to bypass document length limits (GEODE-10575 #8002, GEODE-10576 #8003)

  • Critical Security Patches: Remediated CVE-2026-0636, CVE-2026-5598, and CVE-2025-14813 in Bouncy Castle transitive dependency (GEODE-10583 #8008)

  • Denial-of-service (DoS) Fixes: Remediated CVE-2025-8671 in HttpCore5 and HttpCore5-H2 (GEODE-10577 #8004)

Full Changelog: apache/geode@rel/v2.0.1...rel/v2.0.2

Apache Geode 2.0.1

Apache Geode version 2.0.1 focuses on critical security vulnerability remediations and dependency updates to ensure the ongoing stability and security of the platform.

Highlights

... (truncated)

Commits
  • 39c57fd [GEODE-10640] Fix logging
  • f7c479d [GEODE-10630] The source distribution does not complete ./gradlew build (#8062)
  • c58022f GEODE-10632: Add release signing key to KEYS (#8060)
  • 551d174 [GEODE-10614] Preparation of release 2.0.3 (#8055)
  • 8b4a2ad Backport develop commits to support/2.0 for the 2.0.3 release (#8039)
  • 1685bb4 GEODE-10584: Bump version to 2.0.3
  • 3fe7224 GEODE-10584: Replace 2.0.1 with 2.0.2 as old version
  • e8d5160 GEODE-10584: Replace 2.0.1 with 2.0.2 as old version
  • 096f606 GEODE-10584: Replace 2.0.1 with 2.0.2 as old version
  • 1f113b5 GEODE-10584: update Dockerfile to apache-geode 2.0.2
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 21, 2026
@dependabot dependabot Bot mentioned this pull request Sep 21, 2026
Closed
@DominiqueComte
DominiqueComte commented Oct 25, 2026
Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
Bump org.apache.geode:geode-core from 1.15.2 to 2.0.3
438e452 
Bumps [org.apache.geode:geode-core](https://github.com/apache/geode) from 1.15.2 to 2.0.3.
- [Release notes](https://github.com/apache/geode/releases)
- [Commits](apache/geode@rel/v1.15.2...rel/v2.0.3)

---
updated-dependencies:
- dependency-name: org.apache.geode:geode-core
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/org.apache.geode-geode-core-2.0.3 branch from de9598d to 438e452 Compare October 25, 2026 02:28
@DominiqueComte
DominiqueComte merged commit 370acca into master Oct 25, 2026
1 check passed
@DominiqueComte
DominiqueComte deleted the dependabot/maven/org.apache.geode-geode-core-2.0.3 branch October 25, 2026 02:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DominiqueComte
0