From a6a7ad27f2fbc1f2c02dcc38c526c96c0d82fb39 Mon Sep 17 00:00:00 2001 From: Susan Hert Date: Wed, 2 Sep 2026 11:36:50 -0700 Subject: [PATCH 1/4] Spring Version updates (#1499) --- gradle.properties | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gradle.properties b/gradle.properties index 05bf3be47c..0584b2a934 100644 --- a/gradle.properties +++ b/gradle.properties @@ -175,7 +175,7 @@ grpcVersion=1.82.1 # "java.lang.NoSuchMethodError: 'void com.google.gson.internal.ConstructorConstructor.(java.util.Map)'" errors gsonVersion=2.8.9 -guavaVersion=33.6.0-jre +guavaVersion=33.7.1-jre # force hadoop-hdfs-client for CVE-2021-37404, CVE-2022-25168, CVE-2022-26612, CVE-2021-25642, CVE-2021-33036, CVE-2023-26031, hadoopHdfsClientVersion=3.4.1 @@ -304,8 +304,8 @@ snappyJavaVersion=1.1.10.8 # Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version springBootVersion=4.1.0 # This usually matches the Spring Framework version dictated by springBootVersion -springVersion=7.0.8 -springAiVersion=2.0.0 +springVersion=7.0.9 +springAiVersion=2.0.1 sqliteJdbcVersion=3.53.2.0 From 3e92a8220cb6f22035f6c1800ab5cdd74f818e8a Mon Sep 17 00:00:00 2001 From: Binal Patel Date: Thu, 3 Sep 2026 21:23:05 -0600 Subject: [PATCH 2/4] Document the SameSite requirement for SAML reauthentication (#1472) - Document the SameSite behavior in server/configs/application.properties - Ship same-site, secure, and http-only commented out --- server/configs/application.properties | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/server/configs/application.properties b/server/configs/application.properties index 74fa7b0a96..284897febe 100644 --- a/server/configs/application.properties +++ b/server/configs/application.properties @@ -120,6 +120,19 @@ mail.smtpUser=@@smtpUser@@ # HTTP session timeout for users - defaults to 30 minutes #server.servlet.session.timeout=30m +# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value, +# Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period +# covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the +# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more +# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees +# a guest on that request and rejects the reauthentication, and the response mints a guest session whose +# Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None +# keeps the session attached to the callback and is only honored on Secure cookies, +# so this requires HTTPS. +#server.servlet.session.cookie.same-site=none +#server.servlet.session.cookie.secure=true +#server.servlet.session.cookie.http-only=true + ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve #jsonaccesslog.enabled=true From 1cf7e47738844214d6a35a17c5e4f7714a374552 Mon Sep 17 00:00:00 2001 From: Adam Rauch Date: Sat, 5 Sep 2026 09:32:39 -0700 Subject: [PATCH 3/4] Suppress reactor-netty CVE (#1501) ## Rationale Suppress until newer Azure Identity + Reactor Netty versions are available --- dependencyCheckSuppression.xml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml index 1cab9c8187..75137d030f 100644 --- a/dependencyCheckSuppression.xml +++ b/dependencyCheckSuppression.xml @@ -507,4 +507,23 @@ cpe:/a:opentelemetry:opentelemetry + + + + ^pkg:maven/io\.projectreactor\.netty/reactor-netty-core@.*$ + cpe:/a:pivotal:reactor_netty + + + + ^pkg:maven/io\.projectreactor\.netty/reactor-netty-http@.*$ + cpe:/a:pivotal:reactor_netty + From e55c624332bb0d11af358c7c0bbd05f9ef5088ca Mon Sep 17 00:00:00 2001 From: Daria Bodiakova <70635654+DariaBod@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:35:27 -0700 Subject: [PATCH 4/4] Merge 26.7 to 26.9 --- gradle.properties | 6 +++--- server/configs/application.properties | 13 +++++++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/gradle.properties b/gradle.properties index baf53fbc05..25ac8664f6 100644 --- a/gradle.properties +++ b/gradle.properties @@ -175,7 +175,7 @@ grpcVersion=1.83.1 # "java.lang.NoSuchMethodError: 'void com.google.gson.internal.ConstructorConstructor.(java.util.Map)'" errors gsonVersion=2.8.9 -guavaVersion=33.6.0-jre +guavaVersion=33.7.1-jre # force hadoop-hdfs-client for CVE-2021-37404, CVE-2022-25168, CVE-2022-26612, CVE-2021-25642, CVE-2021-33036, CVE-2023-26031, hadoopHdfsClientVersion=3.4.1 @@ -308,8 +308,8 @@ snappyJavaVersion=1.1.10.8 # Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version springBootVersion=4.1.0 # This usually matches the Spring Framework version dictated by springBootVersion -springVersion=7.0.8 -springAiVersion=2.0.0 +springVersion=7.0.9 +springAiVersion=2.0.1 sqliteJdbcVersion=3.53.2.1 diff --git a/server/configs/application.properties b/server/configs/application.properties index 74fa7b0a96..284897febe 100644 --- a/server/configs/application.properties +++ b/server/configs/application.properties @@ -120,6 +120,19 @@ mail.smtpUser=@@smtpUser@@ # HTTP session timeout for users - defaults to 30 minutes #server.servlet.session.timeout=30m +# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value, +# Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period +# covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the +# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more +# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees +# a guest on that request and rejects the reauthentication, and the response mints a guest session whose +# Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None +# keeps the session attached to the callback and is only honored on Secure cookies, +# so this requires HTTPS. +#server.servlet.session.cookie.same-site=none +#server.servlet.session.cookie.secure=true +#server.servlet.session.cookie.http-only=true + ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve #jsonaccesslog.enabled=true