Skip to content

Build: Bump httpcore5 and httpcore5-h2 dependencies to 5.4.3 - #17712

Open
ksikocinski-relativity wants to merge 1 commit into
apache:mainfrom
ksikocinski-relativity:bump-httpcore5-5.4.3
Open

Build: Bump httpcore5 and httpcore5-h2 dependencies to 5.4.3#17712
ksikocinski-relativity wants to merge 1 commit into
apache:mainfrom
ksikocinski-relativity:bump-httpcore5-5.4.3

Conversation

@ksikocinski-relativity

Copy link
Copy Markdown

Build: Bump httpcore5 and httpcore5-h2 to 5.4.3

Enforces httpcore5 5.4.3 and httpcore5-h2 5.4.3 across all subprojects via dependency substitution to patch two CVEs:

  • CVE-2026-54399 fixed in org.apache.httpcomponents.core5:httpcore5 5.4.3
  • CVE-2026-54428 fixed in org.apache.httpcomponents.core5:httpcore5-h2 5.4.3

Changes:

  • Added httpcomponents-httpcore5 = "5.4.3" version entry to gradle/libs.versions.toml
  • Added httpcomponents-httpcore5 and httpcomponents-httpcore5h2 library aliases to gradle/libs.versions.toml
  • Added substitution rules in build.gradle to force the patched version across all transitive dependencies

@github-actions github-actions Bot added the build label Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants