From 31e744e1d0992ea631c5fa01688cfae505530dbb Mon Sep 17 00:00:00 2001
From: CBL-Mariner Servicing Account <cblmargh@microsoft.com>
Date: Thu, 10 Sep 2026 10:18:38 +0000
Subject: [PATCH 1/2] Upgrade ant to 1.10.18 for CVE-2026-78254

---
 SPECS/ant/ant.signatures.json | 2 +-
 SPECS/ant/ant.spec            | 5 ++++-
 cgmanifest.json               | 4 ++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/SPECS/ant/ant.signatures.json b/SPECS/ant/ant.signatures.json
index 0666ac1577e..4d9b60096c6 100644
--- a/SPECS/ant/ant.signatures.json
+++ b/SPECS/ant/ant.signatures.json
@@ -2,6 +2,6 @@
   "Signatures": {
     "ant-bootstrap.pom.in": "85d35aedfb5ccc60ba1642b4c7624d092f34b253662d3c6c8f2bc1982dcad580",
     "ant.conf": "8a0bace4a527bd0ff35ad0b0a31c1f7bf30fa186e98cd9dc5142a97098f36ddf",
-    "apache-ant-1.10.14-src.tar.gz": "9a5fe31f44d1eb62590cbe38e4fab25b25e2f68643b38a54b66498e0bf621b54"
+    "apache-ant-1.10.18-src.tar.gz": "a615c40df1812ddc2d7ab864b04aff4a02703a4c2da65b92fbf40b940129db33"
   }
 }
diff --git a/SPECS/ant/ant.spec b/SPECS/ant/ant.spec
index 0b62f5e4232..bf92bc551aa 100644
--- a/SPECS/ant/ant.spec
+++ b/SPECS/ant/ant.spec
@@ -22,7 +22,7 @@
 
 Summary:        Apache Ant
 Name:           ant
-Version:        1.10.14
+Version:        1.10.18
 Release:        1%{?dist}
 License:        ASL 2.0 AND W3C
 Vendor:         Microsoft Corporation
@@ -263,6 +263,9 @@ popd
 %{_bindir}/*.py*
 
 %changelog
+* Thu Sep 10 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.10.18-1
+- Auto-upgrade to 1.10.18 - for CVE-2026-78254
+
 * Thu Nov 02 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.10.14-1
 - Auto-upgrade to 1.10.14 - Azure Linux 3.0 - package upgrades
 
diff --git a/cgmanifest.json b/cgmanifest.json
index 20f5cd6aa0d..9162bf19bd4 100644
--- a/cgmanifest.json
+++ b/cgmanifest.json
@@ -235,8 +235,8 @@
         "type": "other",
         "other": {
           "name": "ant",
-          "version": "1.10.14",
-          "downloadUrl": "https://archive.apache.org/dist/ant/source/apache-ant-1.10.14-src.tar.gz"
+          "version": "1.10.18",
+          "downloadUrl": "https://archive.apache.org/dist/ant/source/apache-ant-1.10.18-src.tar.gz"
         }
       }
     },

From c058aeb89a40e4d0962b0a01cb694041e1e92345 Mon Sep 17 00:00:00 2001
From: Kanishk Bansal <kanbansal@microsoft.com>
Date: Thu, 10 Sep 2026 17:39:44 +0000
Subject: [PATCH 2/2] Fix patches

---
 SPECS/ant/apache-ant-bootstrap.patch   |  6 +++---
 SPECS/ant/apache-ant-no-test-jar.patch | 19 ++++++++++++++-----
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/SPECS/ant/apache-ant-bootstrap.patch b/SPECS/ant/apache-ant-bootstrap.patch
index 7ecd73dc4c4..995485dfbe7 100644
--- a/SPECS/ant/apache-ant-bootstrap.patch
+++ b/SPECS/ant/apache-ant-bootstrap.patch
@@ -1,6 +1,6 @@
---- apache-ant-1.10.7/bootstrap.sh	2019-09-01 08:14:10.000000000 +0200
-+++ apache-ant-1.10.7/bootstrap.sh	2019-10-12 12:34:23.892369973 +0200
-@@ -143,7 +143,7 @@
+--- apache-ant-1.10.18/bootstrap.sh	2026-09-03 16:22:52.000000000 +0000
++++ apache-ant-1.10.18/bootstrap.sh	2026-09-10 16:44:40.000000000 +0000
+@@ -144,7 +144,7 @@
    echo ... Compiling Ant Classes with ${JAVAC_RELEASE_VERSION}
  fi
  
diff --git a/SPECS/ant/apache-ant-no-test-jar.patch b/SPECS/ant/apache-ant-no-test-jar.patch
index 4ea0e24331d..9642a924ac0 100644
--- a/SPECS/ant/apache-ant-no-test-jar.patch
+++ b/SPECS/ant/apache-ant-no-test-jar.patch
@@ -1,11 +1,20 @@
---- apache-ant-1.10.7/build.xml	2019-09-01 08:14:10.000000000 +0200
-+++ apache-ant-1.10.7/build.xml	2019-10-12 12:30:11.014986025 +0200
-@@ -976,7 +976,7 @@
+--- apache-ant-1.10.18/build.xml	2026-09-03 16:22:52.000000000 +0000
++++ apache-ant-1.10.18/build.xml	2026-09-10 16:44:40.000000000 +0000
+@@ -1041,7 +1041,7 @@
           Create the essential distribution that can run Apache Ant
         ===================================================================
    -->
--  <target name="dist-lite" depends="jars,test-jar,-ant-dist-warn-jdk9+"
-+  <target name="dist-lite" depends="jars,-ant-dist-warn-jdk9+"
+-  <target name="dist-lite" depends="jars,test-jar,component-boms,-ant-dist-warn-jdk9+"
++  <target name="dist-lite" depends="jars,component-boms,-ant-dist-warn-jdk9+"
            description="--> creates a minimum distribution to run Apache Ant">
  
      <mkdir dir="${dist.dir}"/>
+@@ -2299,7 +2299,7 @@
+   </target>
+ 
+   <target name="component-boms"
+-          depends="-init-cyclonedx,jars,test-jar"
++          depends="-init-cyclonedx,jars"
+           xmlns:cdx="antlib:org.apache.ant.cyclonedx"
+           if="cyclonedx.antlib.present">
+