From b67aea4a5c6638272d9c93bb42a7a28facfd80fb Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 07:57:00 +0000 Subject: [PATCH 1/3] Update logback and GitHub Actions to newest stable Maven: - logback-classic 1.6.2 -> 1.6.3 (BitcoinAddressFinder already ships 1.6.3; this realigns the cross-repo pin) GitHub Actions: - actions/setup-java v5 -> v6 (37 call sites) setup-java v6 is an ESM rewrite that drops only the legacy "adopt" distributions and renames jdkFile -> jdk-file (deprecated alias kept). Every job here uses temurin, so the major bump is a no-op for this pipeline. Everything else was already current: codeql-action and osv-scanner-action are at their newest releases, and the exact pins Jimver/cuda-toolkit@v0.2.36 and jakoch/install-vulkan-sdk-action@v1.6.0 are both the latest available. AGP 9.3.0 is the newest stable and the CI gradle-version 9.6.1 already exceeds its 9.5.0 default, so the Gradle side is left untouched. Verified: mvn -f llama/pom.xml validate passes, including the enforcer DependencyConvergence rule. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J --- .github/workflows/codeql.yml | 2 +- .github/workflows/publish.yml | 70 ++++++++++++++++----------------- .github/workflows/sonarqube.yml | 2 +- llama/pom.xml | 2 +- 4 files changed, 38 insertions(+), 38 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b73e28b44..902d2c8a3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,7 @@ jobs: security-events: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: { java-version: '21', distribution: temurin } - uses: github/codeql-action/init@v4 with: { languages: java, queries: +security-and-quality } diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index df486cf3f..6cfa60ef8 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -203,7 +203,7 @@ jobs: environment: maven-central steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -325,7 +325,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -358,7 +358,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -382,7 +382,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -425,7 +425,7 @@ jobs: path: models/ key: gguf-models-${{ hashFiles('.github/models.csv') }} enableCrossOsArchive: true - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -633,7 +633,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -690,7 +690,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -734,7 +734,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -773,7 +773,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -914,7 +914,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1045,7 +1045,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1139,7 +1139,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1225,7 +1225,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1314,7 +1314,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1359,7 +1359,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1818,7 +1818,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1903,7 +1903,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1941,7 +1941,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2045,7 +2045,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2124,7 +2124,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2158,7 +2158,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2226,7 +2226,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2295,7 +2295,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2349,7 +2349,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2418,7 +2418,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2487,7 +2487,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2558,7 +2558,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github\validate-models.bat - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2652,7 +2652,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github\validate-models.bat - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2844,7 +2844,7 @@ jobs: with: name: Windows-x86_64-openvino path: ${{ github.workspace }}/llama/src/main/resources_windows_openvino/net/ladenthin/llama/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2939,7 +2939,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github/validate-models.sh - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2977,7 +2977,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github\validate-models.bat - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -3021,7 +3021,7 @@ jobs: with: name: llama-jars path: jars/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -3036,7 +3036,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: { java-version: '${{ env.JAVA_VERSION }}', distribution: temurin } - uses: actions/download-artifact@v8 with: { name: jacoco-report, path: target/site/jacoco/ } @@ -3179,7 +3179,7 @@ jobs: name: Windows-x86_64-openvino path: ${{ github.workspace }}/llama/src/main/resources_windows_openvino/net/ladenthin/llama/ - name: Set up Maven Central Repository - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: 'temurin' @@ -3411,7 +3411,7 @@ jobs: name: Windows-x86_64-openvino path: ${{ github.workspace }}/llama/src/main/resources_windows_openvino/net/ladenthin/llama/ - name: Set up Maven Central Repository - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: ${{ env.JAVA_VERSION }} distribution: 'temurin' diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index 2ee66a0a0..ee1eb8f4a 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -18,7 +18,7 @@ jobs: with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: 21 distribution: 'zulu' diff --git a/llama/pom.xml b/llama/pom.xml index 5c99376fb..9f6a8fff0 100644 --- a/llama/pom.xml +++ b/llama/pom.xml @@ -63,7 +63,7 @@ SPDX-License-Identifier: MIT 2.22.2 3.8.7 2.0.18 - 1.6.2 + 1.6.3 1.27 6.1.3 3.0 From acddda5235effbc8dea7958f5b2b22cc024b457a Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 08:02:27 +0000 Subject: [PATCH 2/3] Record the logback and setup-java bumps in CHANGELOG Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 31b11ab7b..2004d19b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,8 @@ from version 5.0.0 onward. Pre-fork releases (`1.x`–`4.2.0`) were authored by - `QuantizationType.Q2_0` — maps the new upstream `LLAMA_FTYPE_MOSTLY_Q2_0` (llama.cpp b9916) for `LlamaQuantizer`. ### Changed +- `ch.qos.logback:logback-classic` bumped 1.6.2 → 1.6.3 (test/runtime binding only). +- CI actions bumped to latest: `actions/setup-java` v5 → v6. - Upgraded llama.cpp from **b9894 to b9917** (all eight local patches re-verified across the range). ## [5.0.6] - 2026-07-07 From 729f139ffd46fbc446fa3d9b466090bb22dbaba3 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 08:12:53 +0000 Subject: [PATCH 3/3] Pin log4j-api and log4j-to-slf4j to 2.26.1 for CVE-2026-49844 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot alert #5 (moderate, GHSA-qv9r-c865-cp47): log4j-api 2.25.3 is affected by CVE-2026-49844 — MapMessage.asJson() emits bare NaN/Infinity tokens for non-finite floats, so a conformant parser rejects the resulting document. It reaches this repo only as a test-scope transitive: io.github.hakky54:logcaptor 2.12.6 -> org.apache.logging.log4j:log4j-to-slf4j 2.25.3 -> org.apache.logging.log4j:log4j-api 2.25.3 logcaptor 2.12.6 is already the newest release, so there is no upstream bump to wait for, which is why Dependabot reported it could not update to the required version. A dependencyManagement pin is the fix, and it sits next to the existing jspecify / logback-classic pins that guard the same logcaptor/junit test-scope transitives. Both artifacts are pinned together, not just the flagged one: log4j-to-slf4j depends on a matching log4j-api, so pinning only the API would leave the pair skewed. 2.26.1 is the newest patched stable (the advisory names 2.25.5 and 2.26.1; 3.0.0-beta2 is a beta and not adopted). Nothing here reaches a published artifact — the dependency is test scope, which is also why maven-enforcer's DependencyConvergence never flagged the skew (it excludes test/provided by default), exactly as the existing comment above dependencyManagement describes. Verified: all 74 tests across the 4 LogCaptor-using test classes pass on 2.26.1, and the enforcer rules still pass. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J --- CHANGELOG.md | 7 +++++++ llama/pom.xml | 20 ++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2004d19b8..b16593565 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,13 @@ from version 5.0.0 onward. Pre-fork releases (`1.x`–`4.2.0`) were authored by - CI actions bumped to latest: `actions/setup-java` v5 → v6. - Upgraded llama.cpp from **b9894 to b9917** (all eight local patches re-verified across the range). +### Fixed +- **CVE-2026-49844** (GHSA-qv9r-c865-cp47, moderate): `org.apache.logging.log4j:log4j-api` + 2.25.3 arrives as a **test-scope** transitive of `io.github.hakky54:logcaptor` 2.12.6, and + Dependabot could not update it on its own. Pinned `log4j-api` **and** `log4j-to-slf4j` to + **2.26.1** in `dependencyManagement` — both together, since `log4j-to-slf4j` requires a + matching `log4j-api` and the two must not skew. Neither reaches a published artifact. + ## [5.0.6] - 2026-07-07 Feature release. Headline additions are the Android AAR + Kotlin coroutines diff --git a/llama/pom.xml b/llama/pom.xml index 9f6a8fff0..8152285ac 100644 --- a/llama/pom.xml +++ b/llama/pom.xml @@ -71,6 +71,12 @@ SPDX-License-Identifier: MIT 0.16 3.7 2.12.6 + + 2.26.1 1.2.28 + + org.apache.logging.log4j + log4j-api + ${log4j.version} + + + org.apache.logging.log4j + log4j-to-slf4j + ${log4j.version} +