From 2ec9177fd74c83b4e339d81b6e33ea328d1713c1 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 03:30:52 +0000
Subject: [PATCH] chore(deps): bump sigstore-java to 2.4.0 and hold its Apache
 HttpComponents past their advisories

sigstore-java 2.4.0 brings google-http-client-apache-v5, whose httpclient5 5.3.1
and httpcore5/httpcore5-h2 5.2.x osv-scanner flags (GHSA-hjcp-jmpx-g3qm,
GHSA-hf6x-8p5f-cgmf, GHSA-v3jc-474w-2wm6). The three Maven trees manage them at
5.6.5 / 5.4.4 beside the existing gRPC, Bouncy Castle and Guava pins, so
make audit-java is clean again. Supersedes the Dependabot bump of the client pom.

Co-Authored-By: jason.han <hanhuijun@gmail.com>
---
 .../unreleased/sigstore-java-2.4.security.md  |  1 +
 client/java/pom.xml                           | 22 +++++++++++++++++--
 editors/mdk/pom.xml                           | 22 +++++++++++++++++--
 editors/syson/pom.xml                         | 20 ++++++++++++++++-
 4 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 changes/unreleased/sigstore-java-2.4.security.md

diff --git a/changes/unreleased/sigstore-java-2.4.security.md b/changes/unreleased/sigstore-java-2.4.security.md
new file mode 100644
index 0000000000..59c5e15b61
--- /dev/null
+++ b/changes/unreleased/sigstore-java-2.4.security.md
@@ -0,0 +1 @@
+- **The Java client verifies release signatures with `sigstore-java` 2.4.0 instead of 1.3.0, and the Apache HttpComponents it brings are held past their advisories.** The upgrade's `google-http-client-apache-v5` transport pulls `httpclient5` 5.3.1 and `httpcore5`/`httpcore5-h2` 5.2.x, which osv-scanner reports against GHSA-hjcp-jmpx-g3qm, GHSA-hf6x-8p5f-cgmf and GHSA-v3jc-474w-2wm6, so the parent `pom.xml` of the Java client, the SysON plugin and the MDK plugin now manage `httpclient5` at 5.6.5 and `httpcore5`/`httpcore5-h2` at 5.4.4 beside the existing gRPC, Bouncy Castle and Guava pins. The client's verification code is unchanged: the `KeylessVerifier`, `VerificationOptions` and `Bundle` API it uses is the same in 2.x.
diff --git a/client/java/pom.xml b/client/java/pom.xml
index b64664931d..fbd1433641 100644
--- a/client/java/pom.xml
+++ b/client/java/pom.xml
@@ -64,12 +64,15 @@
     <protobuf.version>4.36.2</protobuf.version>
     <junit.version>6.1.3</junit.version>
     <gson.version>2.15.0</gson.version>
-    <sigstore.version>1.3.0</sigstore.version>
+    <sigstore.version>2.4.0</sigstore.version>
     <!-- sigstore-java's transitive dependencies, held past their known advisories
-         (OSV over the CycloneDX SBOM): grpc-netty-shaded, bcprov/bcpkix and guava. -->
+         (OSV over the CycloneDX SBOM): grpc-netty-shaded, bcprov/bcpkix, guava and the
+         Apache HttpComponents its Google HTTP client transport rests on. -->
     <grpc.version>1.85.1</grpc.version>
     <bouncycastle.version>1.86</bouncycastle.version>
     <guava.version>33.7.2-jre</guava.version>
+    <httpcomponents.client5.version>5.6.5</httpcomponents.client5.version>
+    <httpcomponents.core5.version>5.4.4</httpcomponents.core5.version>
     <maven.compiler.plugin.version>3.16.0</maven.compiler.plugin.version>
     <maven.surefire.plugin.version>3.6.1</maven.surefire.plugin.version>
     <maven.jar.plugin.version>3.5.1</maven.jar.plugin.version>
@@ -131,6 +134,21 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.client5</groupId>
+        <artifactId>httpclient5</artifactId>
+        <version>${httpcomponents.client5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5-h2</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>
diff --git a/editors/mdk/pom.xml b/editors/mdk/pom.xml
index 6c30a39533..341fa82c3d 100644
--- a/editors/mdk/pom.xml
+++ b/editors/mdk/pom.xml
@@ -24,11 +24,14 @@
     <maven.surefire.plugin.version>3.6.1</maven.surefire.plugin.version>
     <jacoco.plugin.version>0.8.15</jacoco.plugin.version>
     <opensysml.client.version>0.11.0</opensysml.client.version>
-    <!-- The client's sigstore-java brings grpc-netty-shaded, bcprov/bcpkix and guava; a
-         consumer's own management is what holds them past their known advisories. -->
+    <!-- The client's sigstore-java brings grpc-netty-shaded, bcprov/bcpkix, guava and the
+         Apache HttpComponents under its Google HTTP client transport; a consumer's own
+         management is what holds them past their known advisories. -->
     <grpc.version>1.85.1</grpc.version>
     <bouncycastle.version>1.86</bouncycastle.version>
     <guava.version>33.7.2-jre</guava.version>
+    <httpcomponents.client5.version>5.6.5</httpcomponents.client5.version>
+    <httpcomponents.core5.version>5.4.4</httpcomponents.core5.version>
   </properties>
   <dependencyManagement>
     <dependencies>
@@ -59,6 +62,21 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.client5</groupId>
+        <artifactId>httpclient5</artifactId>
+        <version>${httpcomponents.client5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.httpcomponents.core5</groupId>
+        <artifactId>httpcore5-h2</artifactId>
+        <version>${httpcomponents.core5.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.junit.jupiter</groupId>
         <artifactId>junit-jupiter</artifactId>
diff --git a/editors/syson/pom.xml b/editors/syson/pom.xml
index 646d098181..fecb352cc4 100644
--- a/editors/syson/pom.xml
+++ b/editors/syson/pom.xml
@@ -27,11 +27,14 @@
         <maven.surefire.plugin.version>3.6.1</maven.surefire.plugin.version>
         <jacoco.plugin.version>0.8.15</jacoco.plugin.version>
         <!-- Held past their known advisories ahead of the Spring Boot BOM, which manages
-             jackson and grpc lower; bouncycastle and guava arrive through the client's sigstore-java. -->
+             jackson, grpc and httpcomponents lower; bouncycastle, guava and the Apache HttpComponents
+             arrive through the client's sigstore-java. -->
         <jackson.version>3.2.4</jackson.version>
         <grpc.version>1.85.1</grpc.version>
         <bouncycastle.version>1.86</bouncycastle.version>
         <guava.version>33.7.2-jre</guava.version>
+        <httpcomponents.client5.version>5.6.5</httpcomponents.client5.version>
+        <httpcomponents.core5.version>5.4.4</httpcomponents.core5.version>
     </properties>
 
     <dependencyManagement>
@@ -70,6 +73,21 @@
                 <artifactId>guava</artifactId>
                 <version>${guava.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>${httpcomponents.client5.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5</artifactId>
+                <version>${httpcomponents.core5.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.httpcomponents.core5</groupId>
+                <artifactId>httpcore5-h2</artifactId>
+                <version>${httpcomponents.core5.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>