Repository navigation
🐛 Bump JDT LS 1.60.0 -> 1.63.0 (fixes bundled jsoup CVE-2026-75140) (#228) - #230
Merged
Merged
Conversation
…228) * 🐛 Bump JDT LS 1.60.0 -> 1.63.0 to pick up fixed jsoup The jdtls tarball bundled in the image ships the vulnerable Java libraries flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9: - jsoup 1.19.1 -> 1.23.2 fixes CVE-2026-75140 (and CVE-2026-71497) - apache ant 1.10.17 -> 1.10.18 (1.10.17 was already past the CVE-2026-78254 fix) Bumps the jdtls download URL (Dockerfile, Dockerfile.test) and the Tycho build target platform (java-analyzer-bundle.target) from 1.60.0 to 1.63.0. Known gap: guava is still vulnerable to CVE-2026-102554 (needs >= 33.7.2); jdtls 1.63.0 ships 33.7.1 and no OSGi-packaged 33.7.2 exists upstream yet, so that one cannot be resolved by a jdtls bump and is tracked separately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Dylan Murray <dymurray@redhat.com> * Run JDT.LS on Java 25 JDT.LS 1.63.0 is built on Eclipse 2026-09, whose bundles (e.g. org.eclipse.core.filesystem) require a JavaSE-25 runtime. Running the server on Java 21 fails OSGi resolution and the application aborts at initialize with "An error has occurred. See the log file", which breaks the Phase 2 integration tests. Bump the runtime JDK in the final image to java-25-openjdk. The Tycho build stage stays on Java 21 since ECJ compiles against the Java 25 bundles without issue. Signed-off-by: Juanma Leflet Estrada <jleflete@redhat.com> --------- Signed-off-by: Dylan Murray <dymurray@redhat.com> Signed-off-by: Juanma Leflet Estrada <jleflete@redhat.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Juanma Leflet Estrada <jleflete@redhat.com> Signed-off-by: Cherry Picker <noreply@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The jdtls tarball bundled in the image ships the vulnerable Java libraries
flagged against mta-cli-rhel9 and mta-java-external-provider-rhel9:
Bumps the jdtls download URL (Dockerfile, Dockerfile.test) and the Tycho
build target platform (java-analyzer-bundle.target) from 1.60.0 to 1.63.0.
Known gap: guava is still vulnerable to CVE-2026-102554 (needs >= 33.7.2);
jdtls 1.63.0 ships 33.7.1 and no OSGi-packaged 33.7.2 exists upstream yet, so
that one cannot be resolved by a jdtls bump and is tracked separately.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Signed-off-by: Dylan Murray dymurray@redhat.com
JDT.LS 1.63.0 is built on Eclipse 2026-09, whose bundles (e.g.
org.eclipse.core.filesystem) require a JavaSE-25 runtime. Running the
server on Java 21 fails OSGi resolution and the application aborts at
initialize with "An error has occurred. See the log file", which breaks
the Phase 2 integration tests.
Bump the runtime JDK in the final image to java-25-openjdk. The Tycho
build stage stays on Java 21 since ECJ compiles against the Java 25
bundles without issue.
Signed-off-by: Juanma Leflet Estrada jleflete@redhat.com
Signed-off-by: Dylan Murray dymurray@redhat.com
Signed-off-by: Juanma Leflet Estrada jleflete@redhat.com
Co-authored-by: Claude Opus 4.8 noreply@anthropic.com
Co-authored-by: Juanma Leflet Estrada jleflete@redhat.com
Signed-off-by: Cherry Picker noreply@github.com