From 3ab06ba09e109f8d07b810b9d4931bf0a76b0576 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 09:49:47 +0530 Subject: [PATCH 01/10] Update jackson-databind dependency to version 2.18.8 to fix CVE-2026-54512 --- instrumentation-security/build.gradle | 2 +- newrelic-security-agent/build.gradle | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/instrumentation-security/build.gradle b/instrumentation-security/build.gradle index e4d65007e..e92d47272 100644 --- a/instrumentation-security/build.gradle +++ b/instrumentation-security/build.gradle @@ -32,7 +32,7 @@ subprojects { dependencies { testImplementation(project(":instrumentation-security-test")) testImplementation("com.newrelic.agent.java:newrelic-api:${nrAPIVersion}") - testImplementation('com.fasterxml.jackson.core:jackson-databind:2.13.4') + testImplementation('com.fasterxml.jackson.core:jackson-databind:2.18.8') } test { diff --git a/newrelic-security-agent/build.gradle b/newrelic-security-agent/build.gradle index f96d9bf14..9c7fbc451 100644 --- a/newrelic-security-agent/build.gradle +++ b/newrelic-security-agent/build.gradle @@ -62,7 +62,7 @@ dependencies { shadowIntoJar ('com.googlecode.json-simple:json-simple:1.1.1'){ exclude(module:'junit', group:'junit') } - shadowIntoJar 'com.fasterxml.jackson.core:jackson-databind:2.14.3' + shadowIntoJar 'com.fasterxml.jackson.core:jackson-databind:2.18.8' shadowIntoJar 'org.java-websocket:Java-WebSocket:1.5.3' shadowIntoJar 'commons-io:commons-io:2.14.0' shadowIntoJar 'org.apache.commons:commons-text:1.10.0' From 7b578a87ea52f5d0a18bf05468961c94427f98cd Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 10:21:06 +0530 Subject: [PATCH 02/10] Update jackson-databind dependency to version 2.18.9 and remove jcenter repository from build files --- THIRD_PARTY_NOTICES.md | 24 ++++++++++++------------ build.gradle | 1 - buildSrc/build.gradle | 1 - instrumentation-security/build.gradle | 2 +- newrelic-security-agent/build.gradle | 2 +- unittest-helper-agent/build.gradle | 1 - 6 files changed, 14 insertions(+), 17 deletions(-) diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index f4fbb8d2e..b4a8101b4 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -12,19 +12,19 @@ can be found at https://github.com/newrelic/. ### Dependencies -**1**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.14.2` +**1**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.18.8` > - **Project URL**: [https://github.com/FasterXML/jackson](https://github.com/FasterXML/jackson) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-databind-2.14.2.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.14.2.jar/META-INF/LICENSE) - - [jackson-databind-2.14.2.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.14.2.jar/META-INF/NOTICE) +> - **Embedded license files**: [jackson-databind-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/LICENSE) + - [jackson-databind-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/NOTICE) -**2**. **Group:** `com.fasterxml.jackson.dataformat` **Name:** `jackson-dataformat-properties` **Version:** `2.14.2` +**2**. **Group:** `com.fasterxml.jackson.dataformat` **Name:** `jackson-dataformat-properties` **Version:** `2.18.8` > - **Project URL**: [https://github.com/FasterXML/jackson-dataformats-text](https://github.com/FasterXML/jackson-dataformats-text) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-dataformat-properties-2.14.2.jar/META-INF/LICENSE](./third-party-dependencies/jackson-dataformat-properties-2.14.2.jar/META-INF/LICENSE) - - [jackson-dataformat-properties-2.14.2.jar/META-INF/NOTICE](./third-party-dependencies/jackson-dataformat-properties-2.14.2.jar/META-INF/NOTICE) +> - **Embedded license files**: [jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE) + - [jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE) **3**. **Group:** `com.github.erosb` **Name:** `everit-json-schema` **Version:** `1.14.2` > - **POM Project URL**: [https://github.com/erosb/everit-json-schema](https://github.com/erosb/everit-json-schema) @@ -83,19 +83,19 @@ can be found at https://github.com/newrelic/. > - **POM License**: The Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [newrelic-api-8.3.0-SNAPSHOT.jar/LICENSE](./third-party-dependencies/newrelic-api-8.3.0-SNAPSHOT.jar/LICENSE) -**14**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.14.2` +**14**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.18.8` > - **Project URL**: [https://github.com/FasterXML/jackson](https://github.com/FasterXML/jackson) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-databind-2.14.2.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.14.2.jar/META-INF/LICENSE) - - [jackson-databind-2.14.2.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.14.2.jar/META-INF/NOTICE) +> - **Embedded license files**: [jackson-databind-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/LICENSE) + - [jackson-databind-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/NOTICE) -**15**. **Group:** `com.fasterxml.jackson.dataformat` **Name:** `jackson-dataformat-properties` **Version:** `2.14.2` +**15**. **Group:** `com.fasterxml.jackson.dataformat` **Name:** `jackson-dataformat-properties` **Version:** `2.18.8` > - **Project URL**: [https://github.com/FasterXML/jackson-dataformats-text](https://github.com/FasterXML/jackson-dataformats-text) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-dataformat-properties-2.14.2.jar/META-INF/LICENSE](./third-party-dependencies/jackson-dataformat-properties-2.14.2.jar/META-INF/LICENSE) - - [jackson-dataformat-properties-2.14.2.jar/META-INF/NOTICE](./third-party-dependencies/jackson-dataformat-properties-2.14.2.jar/META-INF/NOTICE) +> - **Embedded license files**: [jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE) + - [jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE) **16**. **Group:** `com.googlecode.json-simple` **Name:** `json-simple` **Version:** `1.1.1` > - **POM Project URL**: [http://code.google.com/p/json-simple/](http://code.google.com/p/json-simple/) diff --git a/build.gradle b/build.gradle index 2ce4efad3..659b9bd82 100644 --- a/build.gradle +++ b/build.gradle @@ -53,7 +53,6 @@ subprojects { url 'https://oss.sonatype.org/content/repositories/snapshots/' } mavenCentral() - jcenter() } // SNAPSHOTs are considered to be "changing dependencies" and they are cached by gradle for 24 hours by default. diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle index 2a1aeca34..d9a9f716f 100644 --- a/buildSrc/build.gradle +++ b/buildSrc/build.gradle @@ -7,7 +7,6 @@ sourceCompatibility = 1.8 repositories { mavenLocal() mavenCentral() - jcenter() maven { url 'https://plugins.gradle.org/m2/' } diff --git a/instrumentation-security/build.gradle b/instrumentation-security/build.gradle index e92d47272..c0cf6d1b8 100644 --- a/instrumentation-security/build.gradle +++ b/instrumentation-security/build.gradle @@ -32,7 +32,7 @@ subprojects { dependencies { testImplementation(project(":instrumentation-security-test")) testImplementation("com.newrelic.agent.java:newrelic-api:${nrAPIVersion}") - testImplementation('com.fasterxml.jackson.core:jackson-databind:2.18.8') + testImplementation('com.fasterxml.jackson.core:jackson-databind:2.18.9') } test { diff --git a/newrelic-security-agent/build.gradle b/newrelic-security-agent/build.gradle index 9c7fbc451..5f8e8497e 100644 --- a/newrelic-security-agent/build.gradle +++ b/newrelic-security-agent/build.gradle @@ -62,7 +62,7 @@ dependencies { shadowIntoJar ('com.googlecode.json-simple:json-simple:1.1.1'){ exclude(module:'junit', group:'junit') } - shadowIntoJar 'com.fasterxml.jackson.core:jackson-databind:2.18.8' + shadowIntoJar 'com.fasterxml.jackson.core:jackson-databind:2.18.9' shadowIntoJar 'org.java-websocket:Java-WebSocket:1.5.3' shadowIntoJar 'commons-io:commons-io:2.14.0' shadowIntoJar 'org.apache.commons:commons-text:1.10.0' diff --git a/unittest-helper-agent/build.gradle b/unittest-helper-agent/build.gradle index 909cbec2a..a8cb6908f 100644 --- a/unittest-helper-agent/build.gradle +++ b/unittest-helper-agent/build.gradle @@ -8,7 +8,6 @@ plugins { repositories { mavenCentral() mavenLocal() - jcenter() } configurations { From b56e8aeb5501c0eaaa38ac83780552ea6fedce3a Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 10:33:19 +0530 Subject: [PATCH 03/10] Add exclusions for Jackson core's version 17/21 entries in relocatedShadowJar task - Fixes Unsupported class file major version 61 error --- newrelic-security-agent/build.gradle | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/newrelic-security-agent/build.gradle b/newrelic-security-agent/build.gradle index 5f8e8497e..aaa29a0e0 100644 --- a/newrelic-security-agent/build.gradle +++ b/newrelic-security-agent/build.gradle @@ -141,6 +141,10 @@ task relocatedShadowJar(type: ShadowJar) { // log4j2 "META-INF/versions/9/module-info.class", "META-INF/services/org.apache.logging*", + // jackson-core's fast-double-parser: shadow 6.0.0's bundled ASM + // can't parse Java 17/21 bytecode + "META-INF/versions/17/**", + "META-INF/versions/21/**", // asm "module-info.class", // httpclient From 4bb4160a4ecd41b77dfac8d4a759ec4fd2026815 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 11:08:56 +0530 Subject: [PATCH 04/10] Add excludeRegex for versioning in verify Instrumentation for JSP-3 and Servlet-6 to exclude development milestone builds and update version range for lettuce-5 --- instrumentation-security/jsp-3/build.gradle | 1 + instrumentation-security/lettuce-5.0/build.gradle | 4 ++-- instrumentation-security/servlet-6.0/build.gradle | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/instrumentation-security/jsp-3/build.gradle b/instrumentation-security/jsp-3/build.gradle index 8a85b3374..9ea436e9c 100644 --- a/instrumentation-security/jsp-3/build.gradle +++ b/instrumentation-security/jsp-3/build.gradle @@ -16,6 +16,7 @@ verifyInstrumentation { passesOnly('jakarta.servlet.jsp:jakarta.servlet.jsp-api:[3.0.0-M1,)') { implementation("jakarta.servlet:jakarta.servlet-api:5.0.0") } + excludeRegex '.*-(M|beta)[0-9]*' } java { diff --git a/instrumentation-security/lettuce-5.0/build.gradle b/instrumentation-security/lettuce-5.0/build.gradle index d06e3cd4f..c6c3952c9 100644 --- a/instrumentation-security/lettuce-5.0/build.gradle +++ b/instrumentation-security/lettuce-5.0/build.gradle @@ -2,7 +2,7 @@ dependencies { implementation(project(":newrelic-security-api")) implementation("com.newrelic.agent.java:newrelic-api:${nrAPIVersion}") implementation("com.newrelic.agent.java:newrelic-weaver-api:${nrAPIVersion}") - implementation group: 'io.lettuce', name: 'lettuce-core', version: '5.0.3.RELEASE' + implementation("io.lettuce:lettuce-core:5.0.3.RELEASE") testImplementation('org.testcontainers:testcontainers:1.20.1') } @@ -13,7 +13,7 @@ jar { } verifyInstrumentation { - passesOnly 'io.lettuce:lettuce-core:[5.0.0.RELEASE,6.5.0.RELEASE)' + passesOnly 'io.lettuce:lettuce-core:[5.0.0.RELEASE,6.8.2.RELEASE)' excludeRegex '.*(RC|M).*' } diff --git a/instrumentation-security/servlet-6.0/build.gradle b/instrumentation-security/servlet-6.0/build.gradle index f669df706..0a9b30731 100644 --- a/instrumentation-security/servlet-6.0/build.gradle +++ b/instrumentation-security/servlet-6.0/build.gradle @@ -13,6 +13,7 @@ jar { verifyInstrumentation { passesOnly 'jakarta.servlet:jakarta.servlet-api:[6.0.0,)' + excludeRegex '.*-(M|beta)[0-9]*' } java { From 83ed8691438cd63d54890f52665d58466069fea3 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 11:30:27 +0530 Subject: [PATCH 05/10] Update jackson-databind version to 2.18.9 in THIRD_PARTY_NOTICES.md --- THIRD_PARTY_NOTICES.md | 50 +++++++++++++++--------------------------- 1 file changed, 18 insertions(+), 32 deletions(-) diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index b4a8101b4..d3aa3adcf 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -12,101 +12,87 @@ can be found at https://github.com/newrelic/. ### Dependencies -**1**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.18.8` +**1**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.18.9` > - **Project URL**: [https://github.com/FasterXML/jackson](https://github.com/FasterXML/jackson) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-databind-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/LICENSE) - - [jackson-databind-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/NOTICE) - -**2**. **Group:** `com.fasterxml.jackson.dataformat` **Name:** `jackson-dataformat-properties` **Version:** `2.18.8` -> - **Project URL**: [https://github.com/FasterXML/jackson-dataformats-text](https://github.com/FasterXML/jackson-dataformats-text) -> - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) -> - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE) - - [jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE) +> - **Embedded license files**: [jackson-databind-2.18.9.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/LICENSE) + - [jackson-databind-2.18.9.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.18.9.jar/META-INF/NOTICE) -**3**. **Group:** `com.github.erosb` **Name:** `everit-json-schema` **Version:** `1.14.2` +**2**. **Group:** `com.github.erosb` **Name:** `everit-json-schema` **Version:** `1.14.2` > - **POM Project URL**: [https://github.com/erosb/everit-json-schema](https://github.com/erosb/everit-json-schema) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) -**4**. **Group:** `commons-codec` **Name:** `commons-codec` **Version:** `1.15` +**3**. **Group:** `commons-codec` **Name:** `commons-codec` **Version:** `1.15` > - **Project URL**: [https://commons.apache.org/proper/commons-codec/](https://commons.apache.org/proper/commons-codec/) > - **POM License**: Apache License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [commons-codec-1.15.jar/META-INF/LICENSE.txt](./third-party-dependencies/commons-codec-1.15.jar/META-INF/LICENSE.txt) - [commons-codec-1.15.jar/META-INF/NOTICE.txt](./third-party-dependencies/commons-codec-1.15.jar/META-INF/NOTICE.txt) -**5**. **Group:** `commons-io` **Name:** `commons-io` **Version:** `2.7` +**4**. **Group:** `commons-io` **Name:** `commons-io` **Version:** `2.7` > - **Project URL**: [https://commons.apache.org/proper/commons-io/](https://commons.apache.org/proper/commons-io/) > - **POM License**: Apache License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [commons-io-2.7.jar/META-INF/LICENSE.txt](./third-party-dependencies/commons-io-2.7.jar/META-INF/LICENSE.txt) - [commons-io-2.7.jar/META-INF/NOTICE.txt](./third-party-dependencies/commons-io-2.7.jar/META-INF/NOTICE.txt) -**6**. **Group:** `commons-net` **Name:** `commons-net` **Version:** `3.9.0` +**5**. **Group:** `commons-net` **Name:** `commons-net` **Version:** `3.9.0` > - **Project URL**: [https://commons.apache.org/proper/commons-net/](https://commons.apache.org/proper/commons-net/) > - **POM License**: Apache License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [commons-net-3.9.0.jar/META-INF/LICENSE.txt](./third-party-dependencies/commons-net-3.9.0.jar/META-INF/LICENSE.txt) - [commons-net-3.9.0.jar/META-INF/NOTICE.txt](./third-party-dependencies/commons-net-3.9.0.jar/META-INF/NOTICE.txt) -**7**. **Group:** `net.openhft` **Name:** `zero-allocation-hashing` **Version:** `0.16` +**6**. **Group:** `net.openhft` **Name:** `zero-allocation-hashing` **Version:** `0.16` > - **POM Project URL**: [https://github.com/OpenHFT/Zero-Allocation-Hashing](https://github.com/OpenHFT/Zero-Allocation-Hashing) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0) -**8**. **Group:** `org.apache.commons` **Name:** `commons-text` **Version:** `1.10.0` +**7**. **Group:** `org.apache.commons` **Name:** `commons-text` **Version:** `1.10.0` > - **Project URL**: [https://commons.apache.org/proper/commons-text](https://commons.apache.org/proper/commons-text) > - **POM License**: Apache License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [commons-text-1.10.0.jar/META-INF/LICENSE.txt](./third-party-dependencies/commons-text-1.10.0.jar/META-INF/LICENSE.txt) - [commons-text-1.10.0.jar/META-INF/NOTICE.txt](./third-party-dependencies/commons-text-1.10.0.jar/META-INF/NOTICE.txt) -**9**. **Group:** `org.apache.commons` **Name:** `commons-compress` **Version:** `1.21` +**8**. **Group:** `org.apache.commons` **Name:** `commons-compress` **Version:** `1.21` > - **Project URL**: [https://commons.apache.org/proper/commons-compress/](https://commons.apache.org/proper/commons-compress/) > - **POM License**: Apache License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [commons-compress-1.21.jar/META-INF/LICENSE.txt](./third-party-dependencies/commons-compress-1.21.jar/META-INF/LICENSE.txt) - [commons-compress-1.21.jar/META-INF/NOTICE.txt](./third-party-dependencies/commons-compress-1.21.jar/META-INF/NOTICE.txt) -**10**. **Group:** `org.java-websocket` **Name:** `Java-WebSocket` **Version:** `1.5.3` +**9**. **Group:** `org.java-websocket` **Name:** `Java-WebSocket` **Version:** `1.5.3` > - **Project URL**: [https://github.com/TooTallNate/Java-WebSocket](https://github.com/TooTallNate/Java-WebSocket) > - **Manifest License**: "MIT License";link="https://github.com/TooTallNate/Java-WebSocket/blob/master/LICENSE" (Not Packaged) > - **POM License**: MIT License - [https://github.com/TooTallNate/Java-WebSocket/blob/master/LICENSE](https://github.com/TooTallNate/Java-WebSocket/blob/master/LICENSE) -**11**. **Group:** `org.slf4j` **Name:** `slf4j-simple` **Version:** `1.7.30` +**10**. **Group:** `org.slf4j` **Name:** `slf4j-simple` **Version:** `1.7.30` > - **POM Project URL**: [http://www.slf4j.org](http://www.slf4j.org) > - **POM License**: MIT License - [http://www.opensource.org/licenses/mit-license.php](http://www.opensource.org/licenses/mit-license.php) -**12**. **Group:** `com.github.oshi` **Name:** `oshi-core` **Version:** `6.4.1` +**11**. **Group:** `com.github.oshi` **Name:** `oshi-core` **Version:** `6.4.1` > - **Manifest Project URL**: [https://github.com/oshi/oshi/oshi-core](https://github.com/oshi/oshi/oshi-core) > - **Manifest License**: "SPDX-License-Identifier: MIT";link="https://opensource.org/licenses/MIT" (Not Packaged) > - **POM License**: SPDX-License-Identifier: MIT - [https://opensource.org/licenses/MIT](https://opensource.org/licenses/MIT) -**13**. **Group:** `com.newrelic.agent.java` **Name:** `newrelic-api` **Version:** `8.3.0-SNAPSHOT` +**12**. **Group:** `com.newrelic.agent.java` **Name:** `newrelic-api` **Version:** `8.3.0-SNAPSHOT` > - **POM Project URL**: [https://github.com/newrelic/newrelic-java-agent](https://github.com/newrelic/newrelic-java-agent) > - **POM License**: The Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [newrelic-api-8.3.0-SNAPSHOT.jar/LICENSE](./third-party-dependencies/newrelic-api-8.3.0-SNAPSHOT.jar/LICENSE) -**14**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.18.8` +**13**. **Group:** `com.fasterxml.jackson.core` **Name:** `jackson-databind` **Version:** `2.18.8` > - **Project URL**: [https://github.com/FasterXML/jackson](https://github.com/FasterXML/jackson) > - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [jackson-databind-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/LICENSE) - [jackson-databind-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-databind-2.18.8.jar/META-INF/NOTICE) -**15**. **Group:** `com.fasterxml.jackson.dataformat` **Name:** `jackson-dataformat-properties` **Version:** `2.18.8` -> - **Project URL**: [https://github.com/FasterXML/jackson-dataformats-text](https://github.com/FasterXML/jackson-dataformats-text) -> - **POM License**: Apache License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) -> - **POM License**: The Apache Software License, Version 2.0 - [https://www.apache.org/licenses/LICENSE-2.0.txt](https://www.apache.org/licenses/LICENSE-2.0.txt) -> - **Embedded license files**: [jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/LICENSE) - - [jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE](./third-party-dependencies/jackson-dataformat-properties-2.18.8.jar/META-INF/NOTICE) - -**16**. **Group:** `com.googlecode.json-simple` **Name:** `json-simple` **Version:** `1.1.1` +**14**. **Group:** `com.googlecode.json-simple` **Name:** `json-simple` **Version:** `1.1.1` > - **POM Project URL**: [http://code.google.com/p/json-simple/](http://code.google.com/p/json-simple/) > - **POM License**: The Apache Software License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) -**17**. **Group:** `com.squareup.okhttp3` **Name:** `okhttp` **Version:** `4.10.0` +**15**. **Group:** `com.squareup.okhttp3` **Name:** `okhttp` **Version:** `4.10.0` > - **POM Project URL**: [https://square.github.io/okhttp/](https://square.github.io/okhttp/) > - **POM License**: The Apache Software License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [okhttp-4.10.0.jar/okhttp3/internal/publicsuffix/NOTICE](./third-party-dependencies/okhttp-4.10.0.jar/okhttp3/internal/publicsuffix/NOTICE) -**18**. **Group:** `org.unbescape` **Name:** `unbescape` **Version:** `1.1.6.RELEASE` +**16**. **Group:** `org.unbescape` **Name:** `unbescape` **Version:** `1.1.6.RELEASE` > - **Project URL**: [http://www.unbescape.org](http://www.unbescape.org) > - **POM License**: The Apache Software License, Version 2.0 - [http://www.apache.org/licenses/LICENSE-2.0.txt](http://www.apache.org/licenses/LICENSE-2.0.txt) > - **Embedded license files**: [unbescape-1.1.6.RELEASE.jar/META-INF/LICENSE.txt](./third-party-dependencies/unbescape-1.1.6.RELEASE.jar/META-INF/LICENSE.txt) From 73a7cc5bb47da53979760e59d2e9b9efdb9ab6d3 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 11:51:44 +0530 Subject: [PATCH 06/10] Update verifyInstrumentation configuration to allow all lettuce-core versions and refine exclusion regex --- instrumentation-security/lettuce-5.0/build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/instrumentation-security/lettuce-5.0/build.gradle b/instrumentation-security/lettuce-5.0/build.gradle index c6c3952c9..97c4d3f21 100644 --- a/instrumentation-security/lettuce-5.0/build.gradle +++ b/instrumentation-security/lettuce-5.0/build.gradle @@ -13,8 +13,8 @@ jar { } verifyInstrumentation { - passesOnly 'io.lettuce:lettuce-core:[5.0.0.RELEASE,6.8.2.RELEASE)' - excludeRegex '.*(RC|M).*' + passesOnly 'io.lettuce:lettuce-core:[5.0.0.RELEASE,)' + excludeRegex '.*(RC|M|alpha|beta)[0-9]*' } site { From e740e2a5febe5b632c7f8b4b64ed4392c91258f3 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 11:55:58 +0530 Subject: [PATCH 07/10] Force jackson-databind version 2.6.7.1 in testRuntimeClasspath to prevent dependency resolution issues for aws-java-sdk-dynamodb --- instrumentation-security/dynamodb-1.11.390/build.gradle | 7 +++++++ instrumentation-security/dynamodb-1.11.453/build.gradle | 7 +++++++ instrumentation-security/dynamodb-1.11.459/build.gradle | 7 +++++++ instrumentation-security/dynamodb-1.11.80/build.gradle | 7 +++++++ 4 files changed, 28 insertions(+) diff --git a/instrumentation-security/dynamodb-1.11.390/build.gradle b/instrumentation-security/dynamodb-1.11.390/build.gradle index 74c3536e0..8cd26bea3 100644 --- a/instrumentation-security/dynamodb-1.11.390/build.gradle +++ b/instrumentation-security/dynamodb-1.11.390/build.gradle @@ -14,6 +14,13 @@ repositories { } } +// aws-java-sdk-dynamodb 1.11.x is compiled against jackson-databind 2.6.x, which still +// has PropertyNamingStrategy.PascalCaseStrategy. The project-wide test jackson-databind +// bump (for CVE remediation) would otherwise win dependency resolution and break it. +configurations.testRuntimeClasspath { + resolutionStrategy.force 'com.fasterxml.jackson.core:jackson-databind:2.6.7.1' +} + jar { manifest { attributes 'Implementation-Title': 'com.newrelic.instrumentation.security.dynamodb-1.11.390' } } diff --git a/instrumentation-security/dynamodb-1.11.453/build.gradle b/instrumentation-security/dynamodb-1.11.453/build.gradle index 23de97157..2e482cfe0 100644 --- a/instrumentation-security/dynamodb-1.11.453/build.gradle +++ b/instrumentation-security/dynamodb-1.11.453/build.gradle @@ -14,6 +14,13 @@ repositories { } } +// aws-java-sdk-dynamodb 1.11.x is compiled against jackson-databind 2.6.x, which still +// has PropertyNamingStrategy.PascalCaseStrategy. The project-wide test jackson-databind +// bump (for CVE remediation) would otherwise win dependency resolution and break it. +configurations.testRuntimeClasspath { + resolutionStrategy.force 'com.fasterxml.jackson.core:jackson-databind:2.6.7.1' +} + jar { manifest { attributes 'Implementation-Title': 'com.newrelic.instrumentation.security.dynamodb-1.11.453' } } diff --git a/instrumentation-security/dynamodb-1.11.459/build.gradle b/instrumentation-security/dynamodb-1.11.459/build.gradle index 36ccf6deb..a13ddb4e9 100644 --- a/instrumentation-security/dynamodb-1.11.459/build.gradle +++ b/instrumentation-security/dynamodb-1.11.459/build.gradle @@ -14,6 +14,13 @@ repositories { } } +// aws-java-sdk-dynamodb 1.11.x is compiled against jackson-databind 2.6.x, which still +// has PropertyNamingStrategy.PascalCaseStrategy. The project-wide test jackson-databind +// bump (for CVE remediation) would otherwise win dependency resolution and break it. +configurations.testRuntimeClasspath { + resolutionStrategy.force 'com.fasterxml.jackson.core:jackson-databind:2.6.7.1' +} + jar { manifest { attributes 'Implementation-Title': 'com.newrelic.instrumentation.security.dynamodb-1.11.459' } } diff --git a/instrumentation-security/dynamodb-1.11.80/build.gradle b/instrumentation-security/dynamodb-1.11.80/build.gradle index deb808797..453cb0c74 100644 --- a/instrumentation-security/dynamodb-1.11.80/build.gradle +++ b/instrumentation-security/dynamodb-1.11.80/build.gradle @@ -14,6 +14,13 @@ repositories { } } +// aws-java-sdk-dynamodb 1.11.x is compiled against jackson-databind 2.6.x, which still +// has PropertyNamingStrategy.PascalCaseStrategy. The project-wide test jackson-databind +// bump (for CVE remediation) would otherwise win dependency resolution and break it. +configurations.testRuntimeClasspath { + resolutionStrategy.force 'com.fasterxml.jackson.core:jackson-databind:2.6.7.1' +} + jar { manifest { attributes 'Implementation-Title': 'com.newrelic.instrumentation.security.dynamodb-1.11.80' } } From 7e3dfc8a969c6010a4d3783bf6b79a0ed1b8ad49 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 12:34:28 +0530 Subject: [PATCH 08/10] Fix regex case sensitivity in verifyInstrumentation and update command type retrieval method to toString --- instrumentation-security/lettuce-5.0/build.gradle | 2 +- .../core/AbstractRedisAsyncCommands_Instrumentation.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/instrumentation-security/lettuce-5.0/build.gradle b/instrumentation-security/lettuce-5.0/build.gradle index 97c4d3f21..4f5482713 100644 --- a/instrumentation-security/lettuce-5.0/build.gradle +++ b/instrumentation-security/lettuce-5.0/build.gradle @@ -14,7 +14,7 @@ jar { verifyInstrumentation { passesOnly 'io.lettuce:lettuce-core:[5.0.0.RELEASE,)' - excludeRegex '.*(RC|M|alpha|beta)[0-9]*' + excludeRegex '.*(RC|M|alpha|BETA)[0-9]*' } site { diff --git a/instrumentation-security/lettuce-5.0/src/main/java/io/lettuce/core/AbstractRedisAsyncCommands_Instrumentation.java b/instrumentation-security/lettuce-5.0/src/main/java/io/lettuce/core/AbstractRedisAsyncCommands_Instrumentation.java index 548d97e90..5920ed508 100644 --- a/instrumentation-security/lettuce-5.0/src/main/java/io/lettuce/core/AbstractRedisAsyncCommands_Instrumentation.java +++ b/instrumentation-security/lettuce-5.0/src/main/java/io/lettuce/core/AbstractRedisAsyncCommands_Instrumentation.java @@ -68,7 +68,7 @@ private void registerExitOperation(boolean isProcessingAllowed, com.newrelic.api private AbstractOperation preprocessSecurityHook(RedisCommand_Instrumentation cmd, String methodDispatch) { try { - String type = cmd.getType().name(); + String type = cmd.getType().toString(); CommandArgs_Instrumentation commandArgs = cmd.getArgs(); List arguments = new ArrayList<>(); for(int i=0 ; i Date: Wed, 29 Jul 2026 15:54:28 +0530 Subject: [PATCH 09/10] Update Changelog for version 1.8.0 --- Changelog.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Changelog.md b/Changelog.md index 14e7ceda6..dbb25e445 100644 --- a/Changelog.md +++ b/Changelog.md @@ -4,6 +4,13 @@ Noteworthy changes to the agent are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.8.0] - TBD +### Changes +- Upgraded _com.fasterxml.jackson.core:jackson-databind_ from version 2.14.2 to 2.18.9 to address [CVE-2026-54512](https://www.cve.org/CVERecord?id=CVE-2026-54512) and [CVE-2026-54513](https://www.cve.org/CVERecord?id=CVE-2026-54513). +- Removed the defunct `jcenter()` repository from `buildSrc`, root, and `unittest-helper-agent` build files, replacing it with `mavenCentral()`/`gradlePluginPortal()` where needed, to unblock dependency resolution now that JCenter is shut down. +- For JSP and Servlet excluded milestone (`-M`) and beta pre-release versions from verification. +- Refined Lettuce instrumentation's to support the full `[5.0.0.RELEASE,)` version range. + ## [1.7.0] - 2025-4-25 ### Adds - [PR-395](https://github.com/newrelic/csec-java-agent/pull/395) **Support for Deserialization Vulnerability Detection**: Implemented mechanisms to detect vulnerabilities arising from unsafe deserialization processes. From a4e50cbb207a299be9a40d0fd97f3a2cd67728a5 Mon Sep 17 00:00:00 2001 From: idawda Date: Wed, 29 Jul 2026 18:10:09 +0530 Subject: [PATCH 10/10] Add dependency review job and fix URL typo in dependency submission workflow --- .github/workflows/dependency-submission.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml index 6fea77078..12874557f 100644 --- a/.github/workflows/dependency-submission.yml +++ b/.github/workflows/dependency-submission.yml @@ -3,6 +3,8 @@ name: Dependency Submission on: push: branches: ['main'] + pull_request: + branches: ['main'] permissions: contents: write @@ -23,5 +25,16 @@ jobs: with: dependency-graph-include-projects: ':newrelic-security-(agent|api)' build-scan-publish: true - build-scan-terms-of-use-url: "https://gralde.com/help/legal-terms-of-use" + build-scan-terms-of-use-url: "https://gradle.com/help/legal-terms-of-use" build-scan-terms-of-use-agree: "yes" + + dependency-review: + needs: dependency-submission # Wait for graph submission to finish + runs-on: ubuntu-latest + steps: + - name: 'Dependency Review' + uses: actions/dependency-review-action@v4 + with: + fail-on-severity: 'low' # Fails the action if CVE is found + retry-on-snapshot-warnings: true + retry-on-snapshot-warnings-timeout: 300 \ No newline at end of file