Cole-Greer opened a new pull request, #3583: URL: https://github.com/apache/tinkerpop/pull/3583
Dependency upgrades to address accumulated CVEs. ### Netty 4.1.136.Final - Bumps `bouncycastle.version` 1.69 → 1.70 to match Netty's own pinned `bcpkix-jdk15on` version. - Fixes `HttpHandlerUtilTest` (Netty's stricter HTTP request-line validation now rejects the test's placeholder URI containing a space). - Updates `NOTICE` files in `gremlin-console`, `gremlin-driver`, `gremlin-server`. ### jackson-databind 2.18.9 - Fixes compile breaks from removed/changed Jackson APIs (`DefaultSerializerProvider.withCaches`, `DeserializationContext.mappingException`). - Updates `GraphSONStreamConstraintsTest` assertions for Jackson's reworded exception messages (behavior unchanged). - Bumps `maven-shade-plugin` 3.4.1 → 3.6.2 (required for jackson-databind 2.18.9's Java 21 multi-release JAR classes; no relocation/behavior changes for our use case). **Breaking change:** jackson-databind 2.18.9 hardens `InetAddress` deserialization to reject hostnames, accepting only literal IP addresses (closes a DNS-lookup-on-untrusted-input vector, jackson-databind#6058, related to CVE-2026-54514). No upstream opt-out exists. This restriction is adopted as-is rather than reintroducing hostname resolution via a custom deserializer. Any GraphSON data with `InetAddress` values stored as hostnames (e.g. `"localhost"`) will fail to deserialize after this upgrade and must be migrated to literal IP addresses. Documented in `docs/src/upgrade/release-3.7.x.asciidoc`. VOTE +1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
