Upgrade actions/setup-java to v6 and pin log4j to 2.26.1 - #402
Merged
Conversation
Maven: - logback-classic 1.6.2 -> 1.6.3 (BitcoinAddressFinder already ships 1.6.3; this realigns the cross-repo pin) GitHub Actions: - actions/setup-java v5 -> v6 (37 call sites) setup-java v6 is an ESM rewrite that drops only the legacy "adopt" distributions and renames jdkFile -> jdk-file (deprecated alias kept). Every job here uses temurin, so the major bump is a no-op for this pipeline. Everything else was already current: codeql-action and osv-scanner-action are at their newest releases, and the exact pins Jimver/cuda-toolkit@v0.2.36 and jakoch/install-vulkan-sdk-action@v1.6.0 are both the latest available. AGP 9.3.0 is the newest stable and the CI gradle-version 9.6.1 already exceeds its 9.5.0 default, so the Gradle side is left untouched. Verified: mvn -f llama/pom.xml validate passes, including the enforcer DependencyConvergence rule. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J
Dependabot alert #5 (moderate, GHSA-qv9r-c865-cp47): log4j-api 2.25.3 is affected by CVE-2026-49844 — MapMessage.asJson() emits bare NaN/Infinity tokens for non-finite floats, so a conformant parser rejects the resulting document. It reaches this repo only as a test-scope transitive: io.github.hakky54:logcaptor 2.12.6 -> org.apache.logging.log4j:log4j-to-slf4j 2.25.3 -> org.apache.logging.log4j:log4j-api 2.25.3 logcaptor 2.12.6 is already the newest release, so there is no upstream bump to wait for, which is why Dependabot reported it could not update to the required version. A dependencyManagement pin is the fix, and it sits next to the existing jspecify / logback-classic pins that guard the same logcaptor/junit test-scope transitives. Both artifacts are pinned together, not just the flagged one: log4j-to-slf4j depends on a matching log4j-api, so pinning only the API would leave the pair skewed. 2.26.1 is the newest patched stable (the advisory names 2.25.5 and 2.26.1; 3.0.0-beta2 is a beta and not adopted). Nothing here reaches a published artifact — the dependency is test scope, which is also why maven-enforcer's DependencyConvergence never flagged the skew (it excludes test/provided by default), exactly as the existing comment above dependencyManagement describes. Verified: all 74 tests across the 4 LogCaptor-using test classes pass on 2.26.1, and the enforcer rules still pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J
bernardladenthin
had a problem deploying
to
startgate
August 25, 2026 08:17 — with 
GitHub Actions
Error
GitHub Actions
Error
bernardladenthin
had a problem deploying
to
maven-central
August 25, 2026 08:17 — with
GitHub Actions
Failure
GitHub Actions
Failure
bernardladenthin
had a problem deploying
to
maven-central
August 25, 2026 08:17 — with
GitHub Actions
Failure
GitHub Actions
Failure
Review Summary ✅This PR addresses three dependency updates with excellent documentation. 1. setup-java v5 → v6 (37 locations)
2. logback-classic 1.6.2 → v1.6.3 (patch bump)
3. CVE-2026-49844 log4j pinning
Overall: ✅ Approve |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/setup-javafrom v5 to v6 across all CI workflows (publish, codeql, sonarqube).ch.qos.logback:logback-classicfrom 1.6.2 to 1.6.3.org.apache.logging.log4j:log4j-apiandlog4j-to-slf4jto 2.26.1 independencyManagementto address CVE-2026-49844 (GHSA-qv9r-c865-cp47, moderate severity).Details
The log4j CVE fix addresses a vulnerability in version 2.25.3, which arrives as a test-scope transitive dependency of
io.github.hakky54:logcaptor2.12.6. Dependabot could not update it independently, so bothlog4j-apiandlog4j-to-slf4jare now explicitly pinned together to 2.26.1 independencyManagement. Neither dependency reaches published artifacts (test-scope only).Test plan
Related issues / PRs
Addresses CVE-2026-49844 (GHSA-qv9r-c865-cp47)
Checklist
CONTRIBUTING.mdandCODE_OF_CONDUCT.mdhttps://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J