From 51c7f48534e05b8cc0473cf67737ea2ad5eab701 Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Thu, 3 Sep 2026 17:11:38 -0700 Subject: [PATCH 1/5] Version updates for 26.10 --- gradle.properties | 44 ++++++++++++++++++------------------ server/embedded/build.gradle | 2 +- 2 files changed, 23 insertions(+), 23 deletions(-) diff --git a/gradle.properties b/gradle.properties index 6e18dc7711..7e1cf59607 100644 --- a/gradle.properties +++ b/gradle.properties @@ -54,7 +54,7 @@ osxProteomicsBinariesVersion=1.0 windowsProteomicsBinariesVersion=1.0 # The current version numbers for the gradle plugins. -artifactoryPluginVersion=5.2.5 +artifactoryPluginVersion=6.0.4 gradleNodePluginVersion=7.1.0 gradlePluginsVersion=10.0.1 owaspDependencyCheckPluginVersion=13.0.0 @@ -121,13 +121,13 @@ cglibNodepVersion=2.2.3 checkerQualVersion=3.53.0 -commonmarkVersion=0.29.0 +commonmarkVersion=0.30.0 # the beanutils version is not the default version brought from commons-validator and/or commons-digester # in the :server:api module but is required for some of our code to compile commonsBeanutilsVersion=1.11.0 commonsCodecVersion=1.22.1 -commonsCollections4Version=4.5.0 +commonsCollections4Version=4.6.0 commonsCollectionsVersion=3.2.2 commonsCompressVersion=1.28.0 commonsDbcpVersion=1.4 @@ -143,11 +143,11 @@ commonsTextVersion=1.15.0 commonsValidatorVersion=1.11.0 commonsVfs2Version=2.10.0 -datadogVersion=1.65.0 +datadogVersion=1.65.1 dom4jVersion=2.2.0 -ehcacheCoreVersion=2.6.8 +ehcacheCoreVersion=2.6.11 eigenbasePropertiesVersion=1.1.6 eigenbaseResgenVersion=1.3.7 eigenbaseXomVersion=1.3.7 @@ -166,7 +166,7 @@ googleHttpClientVersion=2.2.0 googleOauthClientVersion=1.39.0 googleProtocolBufVersion=3.25.9 -graphSupportVersion=1.5.2 +graphSupportVersion=1.5.3 grpcVersion=1.83.1 # Cloud and SequenceAnalysis bring gson in as a transitive dependency. @@ -175,7 +175,7 @@ grpcVersion=1.83.1 # "java.lang.NoSuchMethodError: 'void com.google.gson.internal.ConstructorConstructor.(java.util.Map)'" errors gsonVersion=2.8.9 -guavaVersion=33.6.0-jre +guavaVersion=33.7.0-jre # force hadoop-hdfs-client for CVE-2021-37404, CVE-2022-25168, CVE-2022-26612, CVE-2021-25642, CVE-2021-33036, CVE-2023-26031, hadoopHdfsClientVersion=3.4.1 @@ -195,15 +195,15 @@ httpcoreVersion=4.4.16 intellijKotlinVersion=2.3.10 # Update the three Jackson dependency versions below in tandem, unless one gets a patch release out-of-sync with the others -jacksonVersion=2.21.5 -jacksonDatabindVersion=2.21.5 -jacksonJaxrsBaseVersion=2.21.5 +jacksonVersion=2.21.6 +jacksonDatabindVersion=2.21.6 +jacksonJaxrsBaseVersion=2.21.6 # Note the inconsistent version numbering for "annotations"... it no longer matches the above jacksonAnnotationsVersion=2.21 # Spring Boot brings in a transitive dependency on Jackson 3.x. It has changed package names and can coexist with Jackson 2.x. -jackson3Version=3.1.5 +jackson3Version=3.1.6 # The Jakarta Activation API version that Angus Activation implements. Keep in sync with angusActivationVersion (above). jakartaActivationApiVersion=2.1.4 @@ -243,24 +243,24 @@ jodaTimeVersion=2.14.3 # brought in transitively by Cloud, FileTransfer, SequenceAnalysis, etc. Need to resolve consistently jsr305Version=3.0.2 -orgJsonVersion=20260719 +orgJsonVersion=20260814 -jsoupVersion=1.23.1 +jsoupVersion=1.23.2 junitVersion=4.13.2 -jxlVersion=2.6.3 +jxlVersion=2.6.12 kaptchaVersion=2.3 log4j2Version=2.26.1 -lombokVersion=1.18.46 +lombokVersion=1.18.48 -luceneVersion=10.5.0 +luceneVersion=10.5.1 # Microsoft library for sending OAuth2-authenticated notification emails via the Microsoft Graph API -microsoftGraphVersion=6.67.0 +microsoftGraphVersion=6.69.0 mssqlJdbcVersion=13.4.0.jre11 @@ -306,12 +306,12 @@ slf4jLog4jApiVersion=2.0.18 snappyJavaVersion=1.1.10.8 # Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version -springBootVersion=4.1.0 +springBootVersion=4.1.1 # This usually matches the Spring Framework version dictated by springBootVersion -springVersion=7.0.8 -springAiVersion=2.0.0 +springVersion=7.0.9 +springAiVersion=2.0.1 -sqliteJdbcVersion=3.53.2.1 +sqliteJdbcVersion=3.53.4.0 # SAML brings stax2-api in as a transitive dependency. We force the latest version. stax2ApiVersion=4.2.2 @@ -337,4 +337,4 @@ xercesImplVersion=2.12.2 xmlApisVersion=1.0.b2 # sync with Tika/POI -xmlbeansVersion=5.2.0 +xmlbeansVersion=5.4.0 diff --git a/server/embedded/build.gradle b/server/embedded/build.gradle index 8ce8d72094..27e9501ad3 100644 --- a/server/embedded/build.gradle +++ b/server/embedded/build.gradle @@ -8,7 +8,7 @@ plugins { id "java" id "maven-publish" id "org.springframework.boot" version "${springBootVersion}" - id "io.spring.dependency-management" version "1.0.8.RELEASE" + id "io.spring.dependency-management" version "1.1.7" } // 'dependency-management' plugin doesn't allow us to use 'resolutionStrategy.force' to lock versions From bfa5c6388048e88a89fa551915ffc5bfcb8a56fc Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Wed, 9 Sep 2026 07:59:03 -0700 Subject: [PATCH 2/5] Revert to xmlBeans 5.2.0 (for now) --- gradle.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle.properties b/gradle.properties index 7e1cf59607..080ddc9144 100644 --- a/gradle.properties +++ b/gradle.properties @@ -337,4 +337,4 @@ xercesImplVersion=2.12.2 xmlApisVersion=1.0.b2 # sync with Tika/POI -xmlbeansVersion=5.4.0 +xmlbeansVersion=5.2.0 From afd183e1a2b7bfd05939c05f9d9cf4d1cc03e5d3 Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Wed, 9 Sep 2026 08:49:13 -0700 Subject: [PATCH 3/5] restore app properties comments --- server/configs/application.properties | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/server/configs/application.properties b/server/configs/application.properties index 74fa7b0a96..284897febe 100644 --- a/server/configs/application.properties +++ b/server/configs/application.properties @@ -120,6 +120,19 @@ mail.smtpUser=@@smtpUser@@ # HTTP session timeout for users - defaults to 30 minutes #server.servlet.session.timeout=30m +# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value, +# Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period +# covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the +# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more +# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees +# a guest on that request and rejects the reauthentication, and the response mints a guest session whose +# Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None +# keeps the session attached to the callback and is only honored on Secure cookies, +# so this requires HTTPS. +#server.servlet.session.cookie.same-site=none +#server.servlet.session.cookie.secure=true +#server.servlet.session.cookie.http-only=true + ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve #jsonaccesslog.enabled=true From e53d31328d219cf2c0dd3c671c197c516e1cac5c Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Wed, 9 Sep 2026 10:12:17 -0700 Subject: [PATCH 4/5] Revert update to jxlVersion (Issue 45119 still relevant) --- gradle.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle.properties b/gradle.properties index 4bc3889e41..7557cf5461 100644 --- a/gradle.properties +++ b/gradle.properties @@ -249,7 +249,7 @@ jsoupVersion=1.23.2 junitVersion=4.13.2 -jxlVersion=2.6.12 +jxlVersion=2.6.3 kaptchaVersion=2.3 From d34a05dd275c0a18751589a08478cf40e38e4b3d Mon Sep 17 00:00:00 2001 From: labkey-susanh Date: Wed, 9 Sep 2026 11:24:32 -0700 Subject: [PATCH 5/5] Update xmlbeansVersion (GH Issue 505) --- gradle.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle.properties b/gradle.properties index 7557cf5461..d1a51ad9cf 100644 --- a/gradle.properties +++ b/gradle.properties @@ -337,4 +337,4 @@ xercesImplVersion=2.12.2 xmlApisVersion=1.0.b2 # sync with Tika/POI -xmlbeansVersion=5.2.0 +xmlbeansVersion=5.4.0