From a30755da8af4e72b25b50f3d4bf288a4713b9ead Mon Sep 17 00:00:00 2001 From: nthmost-orkes Date: Mon, 19 Oct 2026 23:23:12 -0700 Subject: [PATCH] Enable Gradle dependency locking + clear the CVEs it revealed The CVE scan reads resolved deps from a lock file; java-sdk committed none, so it scanned thin and showed a false-clean 0. Lock the runtime classpath of the six published client libraries (committed gradle.lockfile per module), which surfaced real HIGH findings -- fixed here: - jackson 2.18.6 -> 2.18.11 (versions.gradle): 8 CVEs incl. 2 RCE (CVE-2026-54512/54513) across jackson-core + jackson-databind - spring-boot-starter 3.5.13 -> 3.5.15 (conductor-client-spring): clears the spring-boot CVE and pulls spring-framework 6.2.19 (spring-expression CVE-2026-41850) - spring-boot-starter 4.0.6 -> 4.0.7 (conductor-client-spring-boot4): pulls spring-framework 7.0.8 (spring-expression CVE-2026-41850) - micrometer-registry-prometheus 1.15.1 -> 1.15.12 (conductor-client-metrics): CVE-2026-40983/40984 Only runtimeClasspath is locked (what ships); all six lockfiles now scan clean and all published modules assemble. --- build.gradle | 14 +++++ conductor-client-ai-spring/gradle.lockfile | 54 +++++++++++++++++++ conductor-client-ai/gradle.lockfile | 35 ++++++++++++ conductor-client-metrics/build.gradle | 2 +- conductor-client-metrics/gradle.lockfile | 46 ++++++++++++++++ conductor-client-spring-boot4/build.gradle | 4 +- conductor-client-spring-boot4/gradle.lockfile | 53 ++++++++++++++++++ conductor-client-spring/build.gradle | 2 +- conductor-client-spring/gradle.lockfile | 53 ++++++++++++++++++ conductor-client/gradle.lockfile | 34 ++++++++++++ versions.gradle | 2 +- 11 files changed, 294 insertions(+), 5 deletions(-) create mode 100644 conductor-client-ai-spring/gradle.lockfile create mode 100644 conductor-client-ai/gradle.lockfile create mode 100644 conductor-client-metrics/gradle.lockfile create mode 100644 conductor-client-spring-boot4/gradle.lockfile create mode 100644 conductor-client-spring/gradle.lockfile create mode 100644 conductor-client/gradle.lockfile diff --git a/build.gradle b/build.gradle index a56efe3cf..58dbe98a7 100644 --- a/build.gradle +++ b/build.gradle @@ -86,3 +86,17 @@ subprojects { } } + +// CVE scan coverage: lock the runtime classpath of the published client libraries +// so the dependency scanner sees pinned, resolved transitive versions (committed +// gradle.lockfile per module). Only runtimeClasspath is locked -- that is what +// actually ships; test and compile-only configs are left unlocked. +def publishedProjects = [ + 'conductor-client', 'conductor-client-ai', 'conductor-client-metrics', + 'conductor-client-spring', 'conductor-client-ai-spring', 'conductor-client-spring-boot4', +] +configure(subprojects.findAll { it.name in publishedProjects }) { + configurations.matching { it.name == 'runtimeClasspath' }.configureEach { + resolutionStrategy.activateDependencyLocking() + } +} diff --git a/conductor-client-ai-spring/gradle.lockfile b/conductor-client-ai-spring/gradle.lockfile new file mode 100644 index 000000000..73845599c --- /dev/null +++ b/conductor-client-ai-spring/gradle.lockfile @@ -0,0 +1,54 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +ch.qos.logback:logback-classic:1.5.34=runtimeClasspath +ch.qos.logback:logback-core:1.5.34=runtimeClasspath +com.fasterxml.jackson.core:jackson-annotations:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-core:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-afterburner:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.18.11=runtimeClasspath +com.fasterxml.jackson:jackson-bom:2.18.11=runtimeClasspath +com.google.errorprone:error_prone_annotations:2.47.0=runtimeClasspath +com.google.guava:failureaccess:1.0.3=runtimeClasspath +com.google.guava:guava:33.6.0-jre=runtimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath +com.google.j2objc:j2objc-annotations:3.1=runtimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath +io.micrometer:micrometer-commons:1.15.12=runtimeClasspath +io.micrometer:micrometer-observation:1.15.12=runtimeClasspath +jakarta.annotation:jakarta.annotation-api:2.1.1=runtimeClasspath +org.apache.commons:commons-lang3:3.19.0=runtimeClasspath +org.apache.logging.log4j:log4j-api:2.24.3=runtimeClasspath +org.apache.logging.log4j:log4j-to-slf4j:2.24.3=runtimeClasspath +org.jetbrains.kotlin:kotlin-reflect:1.8.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.10=runtimeClasspath +org.jetbrains:annotations:13.0=runtimeClasspath +org.jspecify:jspecify:1.0.0=runtimeClasspath +org.openjdk.nashorn:nashorn-core:15.6=runtimeClasspath +org.ow2.asm:asm-analysis:7.3.1=runtimeClasspath +org.ow2.asm:asm-commons:7.3.1=runtimeClasspath +org.ow2.asm:asm-tree:7.3.1=runtimeClasspath +org.ow2.asm:asm-util:7.3.1=runtimeClasspath +org.ow2.asm:asm:7.3.1=runtimeClasspath +org.slf4j:jul-to-slf4j:2.0.18=runtimeClasspath +org.slf4j:slf4j-api:2.0.18=runtimeClasspath +org.springframework.boot:spring-boot-autoconfigure:3.5.15=runtimeClasspath +org.springframework.boot:spring-boot-starter-logging:3.5.15=runtimeClasspath +org.springframework.boot:spring-boot-starter:3.5.15=runtimeClasspath +org.springframework.boot:spring-boot:3.5.15=runtimeClasspath +org.springframework:spring-aop:6.2.19=runtimeClasspath +org.springframework:spring-beans:6.2.19=runtimeClasspath +org.springframework:spring-context:6.2.19=runtimeClasspath +org.springframework:spring-core:6.2.19=runtimeClasspath +org.springframework:spring-expression:6.2.19=runtimeClasspath +org.springframework:spring-jcl:6.2.19=runtimeClasspath +org.yaml:snakeyaml:2.4=runtimeClasspath +empty= diff --git a/conductor-client-ai/gradle.lockfile b/conductor-client-ai/gradle.lockfile new file mode 100644 index 000000000..6b285d2a7 --- /dev/null +++ b/conductor-client-ai/gradle.lockfile @@ -0,0 +1,35 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +com.fasterxml.jackson.core:jackson-annotations:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-core:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-afterburner:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.18.11=runtimeClasspath +com.fasterxml.jackson:jackson-bom:2.18.11=runtimeClasspath +com.google.errorprone:error_prone_annotations:2.47.0=runtimeClasspath +com.google.guava:failureaccess:1.0.3=runtimeClasspath +com.google.guava:guava:33.6.0-jre=runtimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath +com.google.j2objc:j2objc-annotations:3.1=runtimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath +org.apache.commons:commons-lang3:3.19.0=runtimeClasspath +org.jetbrains.kotlin:kotlin-reflect:1.8.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.10=runtimeClasspath +org.jetbrains:annotations:13.0=runtimeClasspath +org.jspecify:jspecify:1.0.0=runtimeClasspath +org.openjdk.nashorn:nashorn-core:15.6=runtimeClasspath +org.ow2.asm:asm-analysis:7.3.1=runtimeClasspath +org.ow2.asm:asm-commons:7.3.1=runtimeClasspath +org.ow2.asm:asm-tree:7.3.1=runtimeClasspath +org.ow2.asm:asm-util:7.3.1=runtimeClasspath +org.ow2.asm:asm:7.3.1=runtimeClasspath +org.slf4j:slf4j-api:1.7.36=runtimeClasspath +empty= diff --git a/conductor-client-metrics/build.gradle b/conductor-client-metrics/build.gradle index 9a4e2e3e0..369a294ef 100644 --- a/conductor-client-metrics/build.gradle +++ b/conductor-client-metrics/build.gradle @@ -13,7 +13,7 @@ ext { apply plugin: 'publish-config' dependencies { - api 'io.micrometer:micrometer-registry-prometheus:1.15.1' + api 'io.micrometer:micrometer-registry-prometheus:1.15.12' implementation project(":conductor-client") implementation "com.squareup.okhttp3:okhttp:${versions.okHttp}" diff --git a/conductor-client-metrics/gradle.lockfile b/conductor-client-metrics/gradle.lockfile new file mode 100644 index 000000000..454829be5 --- /dev/null +++ b/conductor-client-metrics/gradle.lockfile @@ -0,0 +1,46 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +com.fasterxml.jackson.core:jackson-annotations:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-core:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-afterburner:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.18.11=runtimeClasspath +com.fasterxml.jackson:jackson-bom:2.18.11=runtimeClasspath +com.google.errorprone:error_prone_annotations:2.47.0=runtimeClasspath +com.google.guava:failureaccess:1.0.3=runtimeClasspath +com.google.guava:guava:33.6.0-jre=runtimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath +com.google.j2objc:j2objc-annotations:3.1=runtimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath +io.micrometer:micrometer-commons:1.15.12=runtimeClasspath +io.micrometer:micrometer-core:1.15.12=runtimeClasspath +io.micrometer:micrometer-observation:1.15.12=runtimeClasspath +io.micrometer:micrometer-registry-prometheus:1.15.12=runtimeClasspath +io.prometheus:prometheus-metrics-config:1.3.10=runtimeClasspath +io.prometheus:prometheus-metrics-core:1.3.10=runtimeClasspath +io.prometheus:prometheus-metrics-exposition-formats:1.3.10=runtimeClasspath +io.prometheus:prometheus-metrics-exposition-textformats:1.3.10=runtimeClasspath +io.prometheus:prometheus-metrics-model:1.3.10=runtimeClasspath +io.prometheus:prometheus-metrics-tracer-common:1.3.10=runtimeClasspath +org.apache.commons:commons-lang3:3.19.0=runtimeClasspath +org.hdrhistogram:HdrHistogram:2.2.2=runtimeClasspath +org.jetbrains.kotlin:kotlin-reflect:1.8.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.10=runtimeClasspath +org.jetbrains:annotations:13.0=runtimeClasspath +org.jspecify:jspecify:1.0.0=runtimeClasspath +org.latencyutils:LatencyUtils:2.0.3=runtimeClasspath +org.openjdk.nashorn:nashorn-core:15.6=runtimeClasspath +org.ow2.asm:asm-analysis:7.3.1=runtimeClasspath +org.ow2.asm:asm-commons:7.3.1=runtimeClasspath +org.ow2.asm:asm-tree:7.3.1=runtimeClasspath +org.ow2.asm:asm-util:7.3.1=runtimeClasspath +org.ow2.asm:asm:7.3.1=runtimeClasspath +org.slf4j:slf4j-api:1.7.36=runtimeClasspath +empty= diff --git a/conductor-client-spring-boot4/build.gradle b/conductor-client-spring-boot4/build.gradle index 8cefafc4d..08a8b1600 100644 --- a/conductor-client-spring-boot4/build.gradle +++ b/conductor-client-spring-boot4/build.gradle @@ -20,9 +20,9 @@ repositories { dependencies { api project(":conductor-client") - implementation 'org.springframework.boot:spring-boot-starter:4.0.6' + implementation 'org.springframework.boot:spring-boot-starter:4.0.7' - testImplementation 'org.springframework.boot:spring-boot-starter-test:4.0.6' + testImplementation 'org.springframework.boot:spring-boot-starter-test:4.0.7' testRuntimeOnly 'org.junit.platform:junit-platform-launcher' testImplementation "org.mockito:mockito-core:${versions.mockito}" testImplementation "org.mockito:mockito-junit-jupiter:${versions.mockito}" diff --git a/conductor-client-spring-boot4/gradle.lockfile b/conductor-client-spring-boot4/gradle.lockfile new file mode 100644 index 000000000..f9d170c81 --- /dev/null +++ b/conductor-client-spring-boot4/gradle.lockfile @@ -0,0 +1,53 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +ch.qos.logback:logback-classic:1.5.34=runtimeClasspath +ch.qos.logback:logback-core:1.5.34=runtimeClasspath +com.fasterxml.jackson.core:jackson-annotations:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-core:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-afterburner:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.18.11=runtimeClasspath +com.fasterxml.jackson:jackson-bom:2.18.11=runtimeClasspath +com.google.errorprone:error_prone_annotations:2.47.0=runtimeClasspath +com.google.guava:failureaccess:1.0.3=runtimeClasspath +com.google.guava:guava:33.6.0-jre=runtimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath +com.google.j2objc:j2objc-annotations:3.1=runtimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath +commons-logging:commons-logging:1.3.5=runtimeClasspath +io.micrometer:micrometer-commons:1.16.6=runtimeClasspath +io.micrometer:micrometer-observation:1.16.6=runtimeClasspath +jakarta.annotation:jakarta.annotation-api:3.0.0=runtimeClasspath +org.apache.commons:commons-lang3:3.19.0=runtimeClasspath +org.apache.logging.log4j:log4j-api:2.25.4=runtimeClasspath +org.apache.logging.log4j:log4j-to-slf4j:2.25.4=runtimeClasspath +org.jetbrains.kotlin:kotlin-reflect:1.8.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.10=runtimeClasspath +org.jetbrains:annotations:13.0=runtimeClasspath +org.jspecify:jspecify:1.0.0=runtimeClasspath +org.openjdk.nashorn:nashorn-core:15.6=runtimeClasspath +org.ow2.asm:asm-analysis:7.3.1=runtimeClasspath +org.ow2.asm:asm-commons:7.3.1=runtimeClasspath +org.ow2.asm:asm-tree:7.3.1=runtimeClasspath +org.ow2.asm:asm-util:7.3.1=runtimeClasspath +org.ow2.asm:asm:7.3.1=runtimeClasspath +org.slf4j:jul-to-slf4j:2.0.18=runtimeClasspath +org.slf4j:slf4j-api:2.0.18=runtimeClasspath +org.springframework.boot:spring-boot-autoconfigure:4.0.7=runtimeClasspath +org.springframework.boot:spring-boot-starter-logging:4.0.7=runtimeClasspath +org.springframework.boot:spring-boot-starter:4.0.7=runtimeClasspath +org.springframework.boot:spring-boot:4.0.7=runtimeClasspath +org.springframework:spring-aop:7.0.8=runtimeClasspath +org.springframework:spring-beans:7.0.8=runtimeClasspath +org.springframework:spring-context:7.0.8=runtimeClasspath +org.springframework:spring-core:7.0.8=runtimeClasspath +org.springframework:spring-expression:7.0.8=runtimeClasspath +org.yaml:snakeyaml:2.5=runtimeClasspath +empty= diff --git a/conductor-client-spring/build.gradle b/conductor-client-spring/build.gradle index f5d02f10e..4fda65695 100644 --- a/conductor-client-spring/build.gradle +++ b/conductor-client-spring/build.gradle @@ -19,7 +19,7 @@ repositories { dependencies { api project(":conductor-client") - implementation 'org.springframework.boot:spring-boot-starter:3.5.13' + implementation 'org.springframework.boot:spring-boot-starter:3.5.15' testImplementation 'org.springframework.boot:spring-boot-starter-test:3.3.13' } diff --git a/conductor-client-spring/gradle.lockfile b/conductor-client-spring/gradle.lockfile new file mode 100644 index 000000000..70f45961b --- /dev/null +++ b/conductor-client-spring/gradle.lockfile @@ -0,0 +1,53 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +ch.qos.logback:logback-classic:1.5.34=runtimeClasspath +ch.qos.logback:logback-core:1.5.34=runtimeClasspath +com.fasterxml.jackson.core:jackson-annotations:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-core:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-afterburner:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.18.11=runtimeClasspath +com.fasterxml.jackson:jackson-bom:2.18.11=runtimeClasspath +com.google.errorprone:error_prone_annotations:2.47.0=runtimeClasspath +com.google.guava:failureaccess:1.0.3=runtimeClasspath +com.google.guava:guava:33.6.0-jre=runtimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath +com.google.j2objc:j2objc-annotations:3.1=runtimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath +io.micrometer:micrometer-commons:1.15.12=runtimeClasspath +io.micrometer:micrometer-observation:1.15.12=runtimeClasspath +jakarta.annotation:jakarta.annotation-api:2.1.1=runtimeClasspath +org.apache.commons:commons-lang3:3.19.0=runtimeClasspath +org.apache.logging.log4j:log4j-api:2.24.3=runtimeClasspath +org.apache.logging.log4j:log4j-to-slf4j:2.24.3=runtimeClasspath +org.jetbrains.kotlin:kotlin-reflect:1.8.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.10=runtimeClasspath +org.jetbrains:annotations:13.0=runtimeClasspath +org.jspecify:jspecify:1.0.0=runtimeClasspath +org.openjdk.nashorn:nashorn-core:15.6=runtimeClasspath +org.ow2.asm:asm-analysis:7.3.1=runtimeClasspath +org.ow2.asm:asm-commons:7.3.1=runtimeClasspath +org.ow2.asm:asm-tree:7.3.1=runtimeClasspath +org.ow2.asm:asm-util:7.3.1=runtimeClasspath +org.ow2.asm:asm:7.3.1=runtimeClasspath +org.slf4j:jul-to-slf4j:2.0.18=runtimeClasspath +org.slf4j:slf4j-api:2.0.18=runtimeClasspath +org.springframework.boot:spring-boot-autoconfigure:3.5.15=runtimeClasspath +org.springframework.boot:spring-boot-starter-logging:3.5.15=runtimeClasspath +org.springframework.boot:spring-boot-starter:3.5.15=runtimeClasspath +org.springframework.boot:spring-boot:3.5.15=runtimeClasspath +org.springframework:spring-aop:6.2.19=runtimeClasspath +org.springframework:spring-beans:6.2.19=runtimeClasspath +org.springframework:spring-context:6.2.19=runtimeClasspath +org.springframework:spring-core:6.2.19=runtimeClasspath +org.springframework:spring-expression:6.2.19=runtimeClasspath +org.springframework:spring-jcl:6.2.19=runtimeClasspath +org.yaml:snakeyaml:2.4=runtimeClasspath +empty= diff --git a/conductor-client/gradle.lockfile b/conductor-client/gradle.lockfile new file mode 100644 index 000000000..f4b771885 --- /dev/null +++ b/conductor-client/gradle.lockfile @@ -0,0 +1,34 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +com.fasterxml.jackson.core:jackson-annotations:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-core:2.18.11=runtimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.18.11=runtimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-afterburner:2.18.11=runtimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.18.11=runtimeClasspath +com.fasterxml.jackson:jackson-bom:2.18.11=runtimeClasspath +com.google.errorprone:error_prone_annotations:2.47.0=runtimeClasspath +com.google.guava:failureaccess:1.0.3=runtimeClasspath +com.google.guava:guava:33.6.0-jre=runtimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath +com.google.j2objc:j2objc-annotations:3.1=runtimeClasspath +com.squareup.okhttp3:okhttp:4.12.0=runtimeClasspath +com.squareup.okio:okio-jvm:3.6.0=runtimeClasspath +com.squareup.okio:okio:3.6.0=runtimeClasspath +org.apache.commons:commons-lang3:3.19.0=runtimeClasspath +org.jetbrains.kotlin:kotlin-reflect:1.8.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10=runtimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.10=runtimeClasspath +org.jetbrains:annotations:13.0=runtimeClasspath +org.jspecify:jspecify:1.0.0=runtimeClasspath +org.openjdk.nashorn:nashorn-core:15.6=runtimeClasspath +org.ow2.asm:asm-analysis:7.3.1=runtimeClasspath +org.ow2.asm:asm-commons:7.3.1=runtimeClasspath +org.ow2.asm:asm-tree:7.3.1=runtimeClasspath +org.ow2.asm:asm-util:7.3.1=runtimeClasspath +org.ow2.asm:asm:7.3.1=runtimeClasspath +org.slf4j:slf4j-api:1.7.36=runtimeClasspath +empty= diff --git a/versions.gradle b/versions.gradle index 3e79bd492..b085486d8 100644 --- a/versions.gradle +++ b/versions.gradle @@ -2,7 +2,7 @@ ext { versions = [ okHttp : '4.12.0', guava : '33.6.0-jre', - jackson : '2.18.6', + jackson : '2.18.11', archaius : '0.7.12', slf4j : '1.7.36', log4j : '2.25.4',