chore: DH-22397: BouncyCastle constraint for CVE-2026-5598.#7951
chore: DH-22397: BouncyCastle constraint for CVE-2026-5598.#7951cpwright wants to merge 1 commit intodeephaven:mainfrom
Conversation
No docs changes detected for f9e31be |
devinrsmith
left a comment
There was a problem hiding this comment.
I'm confused - I don't see core as having any dependencies on these bounce castle libraries.
./gradlew server-jetty-app:dependencyInsight --dependency bcpkix-jdk18on --configuration runtimeClasspath
./gradlew server-jetty-app:dependencyInsight --dependency bcutil-jdk18on --configuration runtimeClasspath
./gradlew server-jetty-app:dependencyInsight --dependency bcprov-jdk18on --configuration runtimeClasspath
all show up as empty.
Examining the assembled application classpath also shows the same thing:
./gradlew server-jetty-app:installDist
ls -la server/jetty-app/build/install/server-jetty/lib | grep jdk18on
|
@devinrsmith These all show up in the classpath for the :extensions-flight-sql:adbcTest. Adding instrumentation: On main: After adding constraints: |
|
Discussed - don't think this is a Core issue. It's only on the adbcTest classpath. More targeted investigation in Core+. |
No description provided.