From f35974c492ed2786308372bfea34b4bce855bf3e Mon Sep 17 00:00:00 2001 From: Bruno Palermo Date: Tue, 14 Jul 2026 14:17:56 -0300 Subject: [PATCH] Version 1.0.1 Dependency-security patch release: set release version across all modules for the manual release flow (Bookworm does not operate on this public repo). The merge commit of this PR is the 1.0.1 release commit. All changes since 1.0.0 are CVE-clearing transitive pins (#21-#24); no API or behavior changes. thrift's :midje plugin ref stays at the released 1.0.0 for this build and moves to 1.0.1 in the next-dev PR once the 1.0.1 plugin is published. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 10 ++++++++++ core/project.clj | 2 +- http/project.clj | 4 ++-- lein-finagle-clojure/project.clj | 2 +- project.clj | 2 +- thrift/project.clj | 4 ++-- 6 files changed, 17 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 268688b..3906df9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 1.0.1 (2026-07-14) +Dependency-security patch release — CVE-clearing pins over Finagle 24.2.0's frozen transitive set. No API or behavior changes. +- **netty** pinned to `4.1.135.Final` across the aligned set (clears 56 alerts). +- **jackson** core/databind/annotations/module-scala_2.13 aligned at `2.18.9` (GHSA-5jmj-h7xm-6q6v). All four move together because `jackson-module-scala` enforces a matching `jackson-databind` version at runtime. +- **scala-library** `2.13.16` (critical alerts). +- **snakeyaml** `2.4` (CVE-2022-1471 RCE). +- **aws-java-sdk-s3/core** `1.12.797` (drops vulnerable transitive `ion-java`). +- **plexus-utils** `3.6.1`, **guava** `32.0.1-jre`, **httpclient** `4.5.14`, **gson** `2.10.1`. +- `libthrift` remains `0.12.0`: scrooge `24.2.0` codegen requires the pre-`0.13` `TProcessor.process` signature, so the patched `0.23.0` is not adoptable (vulnerable TLS transport is unused — finagle-clojure does TLS via Finagle's Netty transport). + ## 1.0.0 (2026-07-03) - Bump Finagle and scrooge to `24.2.0` (the final Finagle release) and move the built modules (`core`, `http`, `thrift`, `lein-finagle-clojure`) to Scala 2.13 artifacts. `finagle-clojure-template` is not part of the build and remains stale (it predates the Nubank fork). - **Breaking**: remove `finagle-clojure.builder.server` and `finagle-clojure.builder.client`. Finagle removed the underlying `ServerBuilder` API in `21.8.0`. Use the stack pattern instead (`finagle-clojure.http.server`/`finagle-clojure.http.client`); `common-finagle >= 11.38.0` already does. diff --git a/core/project.clj b/core/project.clj index e39ab0d..b84deec 100644 --- a/core/project.clj +++ b/core/project.clj @@ -1,4 +1,4 @@ -(defproject finagle-clojure/core "1.0.1-SNAPSHOT" +(defproject finagle-clojure/core "1.0.1" :description "A light wrapper around Finagle & Twitter Util for Clojure" :url "https://github.com/twitter/finagle-clojure" :license {:name "Apache License, Version 2.0" diff --git a/http/project.clj b/http/project.clj index 3fa384b..f7972dd 100644 --- a/http/project.clj +++ b/http/project.clj @@ -1,4 +1,4 @@ -(defproject finagle-clojure/http "1.0.1-SNAPSHOT" +(defproject finagle-clojure/http "1.0.1" :description "A light wrapper around Finagle HTTP for Clojure" :url "https://github.com/twitter/finagle-clojure" :license {:name "Apache License, Version 2.0" @@ -15,7 +15,7 @@ ;; finagle 24.2.0 (the last Finagle release ever published); all netty ;; artifacts must stay aligned on the same version, including the ;; classified native-epoll jars (conflict resolution is per classifier) - :dependencies [[finagle-clojure/core "1.0.1-SNAPSHOT"] + :dependencies [[finagle-clojure/core "1.0.1"] [com.twitter/finagle-http_2.13 "24.2.0"] [com.twitter/finagle-stats_2.13 "24.2.0"] [org.scala-lang/scala-library "2.13.16"] diff --git a/lein-finagle-clojure/project.clj b/lein-finagle-clojure/project.clj index cdb38ff..1a44a95 100644 --- a/lein-finagle-clojure/project.clj +++ b/lein-finagle-clojure/project.clj @@ -1,4 +1,4 @@ -(defproject lein-finagle-clojure "1.0.1-SNAPSHOT" +(defproject lein-finagle-clojure "1.0.1" :description "A lein plugin for working with finagle-clojure" :url "https://github.com/twitter/finagle-clojure" :license {:name "Apache License, Version 2.0" diff --git a/project.clj b/project.clj index 0f5bbdd..9b29840 100644 --- a/project.clj +++ b/project.clj @@ -1,4 +1,4 @@ -(defproject finagle-clojure "1.0.1-SNAPSHOT" +(defproject finagle-clojure "1.0.1" :description "A light wrapper around Finagle for Clojure" :url "https://github.com/twitter/finagle-clojure" :license {:name "Apache License, Version 2.0" diff --git a/thrift/project.clj b/thrift/project.clj index 0ef4fdf..d5462d1 100644 --- a/thrift/project.clj +++ b/thrift/project.clj @@ -1,4 +1,4 @@ -(defproject finagle-clojure/thrift "1.0.1-SNAPSHOT" +(defproject finagle-clojure/thrift "1.0.1" :description "A light wrapper around finagle-thrift for Clojure" :url "https://github.com/twitter/finagle-clojure" :license {:name "Apache License, Version 2.0" @@ -36,7 +36,7 @@ ;; finagle 24.2.0 (the last Finagle release ever published); all netty ;; artifacts must stay aligned on the same version, including the ;; classified native-epoll jars (conflict resolution is per classifier) - :dependencies [[finagle-clojure/core "1.0.1-SNAPSHOT"] + :dependencies [[finagle-clojure/core "1.0.1"] [com.twitter/finagle-thrift_2.13 "24.2.0"] ;; scrooge 24.2.0 generates `boolean TProcessor.process`; libthrift 0.13+ ;; changed it to void, so 0.12.0 is the newest compatible version