From 1fdd9fb3886c782f150f8ea941d635b58e9a54c4 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:57:37 +0000 Subject: [PATCH 1/3] Update Maven dependencies --- batch/pom.xml | 2 +- its/it-simple-scanner/pom.xml | 2 +- its/it-tests/pom.xml | 6 +++--- lib-shaded/pom.xml | 4 ++-- lib/pom.xml | 4 ++-- pom.xml | 12 ++++++------ 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/batch/pom.xml b/batch/pom.xml index 192f3c58..07e3db18 100644 --- a/batch/pom.xml +++ b/batch/pom.xml @@ -11,7 +11,7 @@ SonarScanner Java Library - Batch - 26.4.0.121862 + 26.10.0.133078 diff --git a/its/it-simple-scanner/pom.xml b/its/it-simple-scanner/pom.xml index 5ecf5f4f..6f466ee4 100644 --- a/its/it-simple-scanner/pom.xml +++ b/its/it-simple-scanner/pom.xml @@ -20,7 +20,7 @@ org.slf4j slf4j-simple - 2.0.13 + 2.0.20 diff --git a/its/it-tests/pom.xml b/its/it-tests/pom.xml index d3db08c0..77fdef04 100644 --- a/its/it-tests/pom.xml +++ b/its/it-tests/pom.xml @@ -13,7 +13,7 @@ 10.0.26 - 1.5.34 + 1.6.5 true true @@ -28,7 +28,7 @@ org.sonarsource.orchestrator sonar-orchestrator-junit4 - 6.4.3.4676 + 6.4.4.4797 test @@ -90,7 +90,7 @@ org.wiremock wiremock-standalone - 3.10.0 + 3.13.2 test diff --git a/lib-shaded/pom.xml b/lib-shaded/pom.xml index 444716ef..fa0307fa 100644 --- a/lib-shaded/pom.xml +++ b/lib-shaded/pom.xml @@ -57,7 +57,7 @@ org.ow2.asm asm - 9.10.1 + 9.11 test @@ -308,7 +308,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.5.2 + 3.6.0 diff --git a/lib/pom.xml b/lib/pom.xml index d4afd84f..e80ee5a7 100644 --- a/lib/pom.xml +++ b/lib/pom.xml @@ -54,12 +54,12 @@ io.github.hakky54 ayza - 10.0.3 + 10.1.0 org.bouncycastle bcprov-jdk18on - 1.85.2 + 1.86 de.siegmar diff --git a/pom.xml b/pom.xml index 1c524c47..7586caa6 100644 --- a/pom.xml +++ b/pom.xml @@ -55,7 +55,7 @@ sonar-scanner-java-library - 5.22.0 + 5.24.0 1.7.36 @@ -65,12 +65,12 @@ org.apache.commons commons-lang3 - 3.20.0 + 3.21.0 commons-io commons-io - 2.21.0 + 2.22.0 org.apache.commons @@ -80,7 +80,7 @@ com.google.code.gson gson - 2.13.2 + 2.14.0 com.google.code.findbugs @@ -90,7 +90,7 @@ org.junit junit-bom - 6.0.3 + 6.1.3 pom import @@ -112,7 +112,7 @@ commons-codec commons-codec - 1.21.0 + 1.23.0 de.siegmar From 9bfb3a514153abe1a3796474e744948e038833e4 Mon Sep 17 00:00:00 2001 From: Dorian Burihabwa Date: Wed, 21 Oct 2026 09:39:05 +0200 Subject: [PATCH 2/3] Use a dedicated version property for sonar-scanner-engine sonar-scanner-engine is not published at the same version as other SonarQube artifacts (26.10.0.133078 is not available), so pin it to the latest release, 26.4.0.121862, via its own property. --- batch/pom.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/batch/pom.xml b/batch/pom.xml index 07e3db18..fb9aabba 100644 --- a/batch/pom.xml +++ b/batch/pom.xml @@ -12,6 +12,7 @@ 26.10.0.133078 + 26.4.0.121862 @@ -24,7 +25,7 @@ org.sonarsource.sonarqube sonar-scanner-engine - ${sonarQubeVersion} + ${sonarScannerEngineVersion} provided From 59d831cf64ba3d846108155010c77e2b2c621a0b Mon Sep 17 00:00:00 2001 From: Michal Zgliczynski Date: Thu, 22 Oct 2026 10:32:53 +0200 Subject: [PATCH 3/3] Fix BouncyCastle 1.86 relocation property checks --- lib-shaded/pom.xml | 12 +++++++++++- .../scanner/lib/shaded/BouncyCastleRelocationIT.java | 3 ++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/lib-shaded/pom.xml b/lib-shaded/pom.xml index fa0307fa..d0ac3f21 100644 --- a/lib-shaded/pom.xml +++ b/lib-shaded/pom.xml @@ -154,8 +154,10 @@ org.bouncycastle.pkcs12.max_it_count org.bouncycastle.pkcs12.allow_sun_secret_keys org.bouncycastle.pkcs12.default + org.bouncycastle.pkcs12.store_it_count org.bouncycastle.x509.crl_cache_ttl org.bouncycastle.x509.enableCRLDP + org.bouncycastle.x509.CRLDP_protocols org.bouncycastle.x509.max_policy_nodes org.bouncycastle.x509.max_cert_path_build_nodes org.bouncycastle.x509.sgp22_name_constraints @@ -175,6 +177,7 @@ org.bouncycastle.drbg.entropy_thread org.bouncycastle.drbg.gather_pause_secs org.bouncycastle.asn1.allow_non_der_time + org.bouncycastle.asn1.allow_zoneless_utctime org.bouncycastle.asn1.max_cons_depth org.bouncycastle.asn1.max_limit org.bouncycastle.asn1.allow_unsafe_integer @@ -184,6 +187,7 @@ org.bouncycastle.dsa.max_size org.bouncycastle.dsa.FIPS186-2for1024bits org.bouncycastle.bcfks.max_it_count + org.bouncycastle.bcfks.store_it_count org.bouncycastle.bcfks.max_scrypt_memory org.bouncycastle.pbe.max_iteration_count org.bouncycastle.pbe.max_scrypt_memory @@ -209,6 +213,11 @@ org.bouncycastle.argon2.max_parallelism org.bouncycastle.pemreader.lax org.bouncycastle.constraints.allow_override + org.bouncycastle.openpgp.max_armor_header_length + org.bouncycastle.openpgp.max_armor_headers + org.bouncycastle.openssh.max_rounds + org.bouncycastle.ocsp.max_response_size + org.bouncycastle.mime.max_depth @@ -225,7 +234,8 @@ copies of module-info.class. bcprov-jdk18on is different: its META-INF/versions/{17,25} carry classes with no base-tree counterpart, registered by always-loaded base Mappings classes - KEM.ML-KEM (versions/17 MLKEMSpi) and the JCE KDF services KDF.PBKDF2*/HKDF-* (versions/25 - PBKDF2Spi/HKDFSpi). Dropping them means the shaded provider would advertise those algorithms + PBKDF2Spi/HKDFSpi), plus SM9KEMSpi in versions/17 starting with bcprov 1.86. + Dropping them means the shaded provider would advertise those algorithms but fail to instantiate them (NoSuchAlgorithmException) on a JDK new enough to activate them - accepted here because this module only ever uses BouncyCastle to load a PKCS12 keystore (HttpClientFactory/ScannerEngineLauncher), never ML-KEM or the public KDF.* services. diff --git a/lib-shaded/src/test/java/org/sonarsource/scanner/lib/shaded/BouncyCastleRelocationIT.java b/lib-shaded/src/test/java/org/sonarsource/scanner/lib/shaded/BouncyCastleRelocationIT.java index d250154e..fb6cff68 100644 --- a/lib-shaded/src/test/java/org/sonarsource/scanner/lib/shaded/BouncyCastleRelocationIT.java +++ b/lib-shaded/src/test/java/org/sonarsource/scanner/lib/shaded/BouncyCastleRelocationIT.java @@ -106,7 +106,8 @@ private static Set collectRealNames(Path jar) throws IOException { if (entry.isDirectory()) { continue; } - String path = entry.getName(); + // Multi-release entries use the same class/resource names as their base-tree counterparts. + String path = entry.getName().replaceFirst("^META-INF/versions/[0-9]+/", ""); int lastSlash = path.lastIndexOf('/'); int lastDotInFileName = path.substring(lastSlash + 1).lastIndexOf('.'); String withoutExtension = lastDotInFileName < 0 ? path : path.substring(0, lastSlash + 1 + lastDotInFileName);