diff --git a/.release-please-manifest.json b/.release-please-manifest.json index c4e46fe4..c76b581c 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.1.0-beta.5" + ".": "0.1.0-beta.6" } \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 3352342e..b491fe6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## 0.1.0-beta.6 (2026-05-20) + +Full Changelog: [v0.1.0-beta.5...v0.1.0-beta.6](https://github.com/langchain-ai/langsmith-java/compare/v0.1.0-beta.5...v0.1.0-beta.6) + +### Bug Fixes + +* patch security alerts — OTel, Tomcat, Jetty, Logback, Spring, SnakeYAML ([#153](https://github.com/langchain-ai/langsmith-java/issues/153)) ([dfa5469](https://github.com/langchain-ai/langsmith-java/commit/dfa54697292c14a987320ba776b580ee25c58f94)) + ## 0.1.0-beta.5 (2026-05-13) Full Changelog: [v0.1.0-beta.4...v0.1.0-beta.5](https://github.com/langchain-ai/langsmith-java/compare/v0.1.0-beta.4...v0.1.0-beta.5) diff --git a/README.md b/README.md index 47a79bec..a8ec2c66 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,8 @@ -[![Maven Central](https://img.shields.io/maven-central/v/com.langchain.smith/langsmith-java)](https://central.sonatype.com/artifact/com.langchain.smith/langsmith-java/0.1.0-beta.5) -[![javadoc](https://javadoc.io/badge2/com.langchain.smith/langsmith-java/0.1.0-beta.5/javadoc.svg)](https://javadoc.io/doc/com.langchain.smith/langsmith-java/0.1.0-beta.5) +[![Maven Central](https://img.shields.io/maven-central/v/com.langchain.smith/langsmith-java)](https://central.sonatype.com/artifact/com.langchain.smith/langsmith-java/0.1.0-beta.6) +[![javadoc](https://javadoc.io/badge2/com.langchain.smith/langsmith-java/0.1.0-beta.6/javadoc.svg)](https://javadoc.io/doc/com.langchain.smith/langsmith-java/0.1.0-beta.6) @@ -13,7 +13,7 @@ To learn more about LangSmith, check out the [docs](https://docs.smith.langchain -The REST API documentation can be found on [docs.smith.langchain.com](https://docs.smith.langchain.com/). Javadocs are available on [javadoc.io](https://javadoc.io/doc/com.langchain.smith/langsmith-java/0.1.0-beta.5). +The REST API documentation can be found on [docs.smith.langchain.com](https://docs.smith.langchain.com/). Javadocs are available on [javadoc.io](https://javadoc.io/doc/com.langchain.smith/langsmith-java/0.1.0-beta.6). @@ -24,7 +24,7 @@ The REST API documentation can be found on [docs.smith.langchain.com](https://do ### Gradle ```kotlin -implementation("com.langchain.smith:langsmith-java:0.1.0-beta.5") +implementation("com.langchain.smith:langsmith-java:0.1.0-beta.6") ``` ### Maven @@ -33,7 +33,7 @@ implementation("com.langchain.smith:langsmith-java:0.1.0-beta.5") com.langchain.smith langsmith-java - 0.1.0-beta.5 + 0.1.0-beta.6 ``` diff --git a/SECURITY_FIX_PLAN.md b/SECURITY_FIX_PLAN.md new file mode 100644 index 00000000..60b27ee4 --- /dev/null +++ b/SECURITY_FIX_PLAN.md @@ -0,0 +1,57 @@ +# Security Fix Plan — langsmith-java + +Validated 2026-05-20 against open Dependabot alerts. + +## Status + +| Item | Priority | Scope | Status | +|------|----------|-------|--------| +| OpenTelemetry 1.32.0 → 1.62.0 | P1 | **Published** (affects end users) | ✅ Done | +| Tomcat 9.0.115 → 9.0.118 | P2 | Example module only (non-published) | ✅ Done | +| Jetty 9.4.57 → 9.4.58 (http2, server) | P3 | Test scope only | ✅ Done | +| Logback 1.2.13 → 1.5.32 | P4 | Test + example scope (non-published) | ✅ Done | +| Spring 5.3.34 → 5.3.39 | P5 | Example module only (non-published) | ✅ Done | +| SnakeYAML 1.31 → 1.32 | P6 | Example module only (non-published) | ✅ Done | +| Spring Boot 3.x upgrade (example) | Upstream | Removes 17 no-fix-available alerts | ⏳ Future | + +## Alerts Already Fixed (Stale — Can Be Dismissed) + +These 15 alerts show as open but the code already addresses them via explicit constraints: + +| Alert # | CVE | Package | Fixed By | +|---------|-----|---------|----------| +| #50 | CVE-2024-13009 | jetty-server | `require("9.4.57.v20241219")` | +| #39 | CVE-2024-8184 | jetty-server | `require("9.4.57.v20241219")` | +| #28 | CVE-2023-44487 | http2-server | sibling of constrained http2-common | +| #27 | CVE-2023-44487 | http2-common | `require("9.4.57.v20241219")` | +| #25 | CVE-2024-22201 | http2-common | `require("9.4.57.v20241219")` | +| #17 | CVE-2023-36478 | http2-hpack | `require("9.4.57.v20241219")` | +| #13 | CVE-2023-26049 | jetty-server | `require("9.4.57.v20241219")` | +| #12 | CVE-2023-26048 | jetty-server | `require("9.4.57.v20241219")` | +| #62 | CVE-2025-48976 | commons-fileupload | `require("1.6.0")` | +| #10 | CVE-2023-24998 | commons-fileupload | `require("1.6.0")` | +| #38 | CVE-2024-47554 | commons-io | `require("2.14.0")` | +| #11 | CVE-2023-1370 | json-smart | `require("2.4.9")` | +| #61 | CVE-2025-52999 | jackson-core | published at 2.18.6 | +| #75 | GHSA-72hv-8253-57qq | jackson-core | published at 2.18.6 (patched version) | +| #76 | GHSA-72hv-8253-57qq | jackson-core | 2.18.6 not in vulnerable range (≥2.19 only) | + +## No Fix Available (Upstream — Spring 5.x Limitations) + +These require either a Spring Boot 3.x upgrade or a Jetty major version upgrade. +They live entirely in the non-published `langsmith-java-example` module. + +| Alert #s | CVEs | Package | Reason | +|---------|------|---------|--------| +| #7 | CVE-2016-1000027 | spring-web | Requires spring-web 6.0 (Spring Boot 3.x) | +| #42, #53 | CVE-2024-38816, CVE-2024-38819 | spring-webmvc | No fix in Spring 5.x | +| #49, #104 | CVE-2025-22235, CVE-2026-40973 | spring-boot | No fix available | +| #55, #56 | CVE-2024-38820 | spring-web/context | No fix available | +| #57 | CVE-2025-22233 | spring-context | No fix available | +| #64 | CVE-2025-41242 | spring-webmvc | No fix in Spring 5.x | +| #67 | CVE-2025-41249 | spring-core | No fix in Spring 5.x | +| #83, #84 | CVE-2026-22735, CVE-2026-22737 | spring-webmvc | No fix in Spring 5.x | +| #99 | CVE-2026-2332 | jetty-http | No 9.x fix | +| #105, #106 | CVE-2026-22741, CVE-2026-22745 | spring-webmvc | No fix available | +| #77 | CVE-2025-11143 | jetty-http | No 9.x fix | +| #40 | CVE-2024-6763 | jetty-http | Fix is Jetty 12 only | diff --git a/build.gradle.kts b/build.gradle.kts index 1e50fcc8..e5354c17 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -9,7 +9,7 @@ repositories { allprojects { group = "com.langchain.smith" - version = "0.1.0-beta.5" // x-release-please-version + version = "0.1.0-beta.6" // x-release-please-version } subprojects { diff --git a/langsmith-java-core/build.gradle.kts b/langsmith-java-core/build.gradle.kts index 63273cdc..4393074d 100644 --- a/langsmith-java-core/build.gradle.kts +++ b/langsmith-java-core/build.gradle.kts @@ -48,10 +48,10 @@ dependencies { implementation("org.apache.httpcomponents.client5:httpclient5:5.3.1") // OpenTelemetry dependencies - api("io.opentelemetry:opentelemetry-api:1.32.0") - api("io.opentelemetry:opentelemetry-sdk:1.32.0") - api("io.opentelemetry:opentelemetry-exporter-otlp:1.32.0") - api("io.opentelemetry.semconv:opentelemetry-semconv:1.23.1-alpha") + api("io.opentelemetry:opentelemetry-api:1.62.0") + api("io.opentelemetry:opentelemetry-sdk:1.62.0") + api("io.opentelemetry:opentelemetry-exporter-otlp:1.62.0") + api("io.opentelemetry.semconv:opentelemetry-semconv:1.41.1") // OpenAI SDK (for wrapOpenAI tracing wrapper) api("com.openai:openai-java:4.30.0") @@ -71,12 +71,12 @@ dependencies { // These constraints apply to the test scope only and do not affect published artifacts. constraints { // CVE-2024-13009, CVE-2025-5115, CVE-2024-22201, CVE-2023-36478 - testImplementation("org.eclipse.jetty:jetty-server") { version { require("9.4.57.v20241219") } } - testImplementation("org.eclipse.jetty.http2:http2-common") { version { require("9.4.57.v20241219") } } - testImplementation("org.eclipse.jetty.http2:http2-hpack") { version { require("9.4.57.v20241219") } } - // CVE-2023-6481, CVE-2023-6378 - testImplementation("ch.qos.logback:logback-core") { version { require("1.2.13") } } - testImplementation("ch.qos.logback:logback-classic") { version { require("1.2.13") } } + testImplementation("org.eclipse.jetty:jetty-server") { version { require("9.4.58.v20250814") } } + testImplementation("org.eclipse.jetty.http2:http2-common") { version { require("9.4.58.v20250814") } } + testImplementation("org.eclipse.jetty.http2:http2-hpack") { version { require("9.4.58.v20250814") } } + // CVE-2023-6481, CVE-2023-6378, CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225 + testImplementation("ch.qos.logback:logback-core") { version { require("1.5.32") } } + testImplementation("ch.qos.logback:logback-classic") { version { require("1.5.32") } } // CVE-2025-48976, CVE-2023-24998 testImplementation("commons-fileupload:commons-fileupload") { version { require("1.6.0") } } // CVE-2024-47554 diff --git a/langsmith-java-core/src/main/kotlin/com/langchain/smith/otel/OtelTraceExporter.kt b/langsmith-java-core/src/main/kotlin/com/langchain/smith/otel/OtelTraceExporter.kt index e3118b23..c63bb52c 100644 --- a/langsmith-java-core/src/main/kotlin/com/langchain/smith/otel/OtelTraceExporter.kt +++ b/langsmith-java-core/src/main/kotlin/com/langchain/smith/otel/OtelTraceExporter.kt @@ -8,7 +8,7 @@ import io.opentelemetry.sdk.common.CompletableResultCode import io.opentelemetry.sdk.resources.Resource import io.opentelemetry.sdk.trace.SdkTracerProvider import io.opentelemetry.sdk.trace.export.BatchSpanProcessor -import io.opentelemetry.semconv.ResourceAttributes +import io.opentelemetry.semconv.ServiceAttributes import java.time.Duration import java.util.concurrent.TimeUnit import org.slf4j.LoggerFactory @@ -46,8 +46,8 @@ private constructor( val resource = Resource.getDefault() .toBuilder() - .put(ResourceAttributes.SERVICE_NAME, serviceName) - .put(ResourceAttributes.SERVICE_VERSION, INSTRUMENTATION_VERSION) + .put(ServiceAttributes.SERVICE_NAME, serviceName) + .put(ServiceAttributes.SERVICE_VERSION, INSTRUMENTATION_VERSION) .build() if (!config.enabled) { diff --git a/langsmith-java-example/build.gradle.kts b/langsmith-java-example/build.gradle.kts index 3a32a498..18b1f1ae 100644 --- a/langsmith-java-example/build.gradle.kts +++ b/langsmith-java-example/build.gradle.kts @@ -35,19 +35,24 @@ dependencies { // None of these affect published artifacts (this is a non-published example module). constraints { // CVE-2025-24813 (CRITICAL), CVE-2026-24734, CVE-2025-55752, CVE-2025-53506, - // CVE-2025-52520, CVE-2025-48989, CVE-2025-48988, CVE-2024-56337, CVE-2024-50379, CVE-2024-34750 + // CVE-2025-52520, CVE-2025-48989, CVE-2025-48988, CVE-2024-56337, CVE-2024-50379, CVE-2024-34750, + // CVE-2026-29145, CVE-2026-29129, CVE-2026-34483, CVE-2026-34487, CVE-2026-34500, CVE-2026-32990, + // CVE-2026-25854, CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, + // CVE-2026-43514, CVE-2026-43515 // Remove this constraint when upgrading to Spring Boot 3.x (which manages Tomcat 10+). - implementation("org.apache.tomcat.embed:tomcat-embed-core") { version { require("9.0.115") } } - implementation("org.apache.tomcat.embed:tomcat-embed-websocket") { version { require("9.0.115") } } - // CVE-2024-22243, CVE-2024-22259, CVE-2024-22262 + implementation("org.apache.tomcat.embed:tomcat-embed-core") { version { require("9.0.118") } } + implementation("org.apache.tomcat.embed:tomcat-embed-websocket") { version { require("9.0.118") } } + // CVE-2024-22243, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, CVE-2024-38808 // Note: CVE-2016-1000027 (CRITICAL) requires spring-web 6.0.0 — needs Spring Boot 3.x upgrade. - implementation("org.springframework:spring-web") { version { require("5.3.34") } } - implementation("org.springframework:spring-webmvc") { version { require("5.3.34") } } - // CVE-2023-6481, CVE-2023-6378 - implementation("ch.qos.logback:logback-core") { version { require("1.2.13") } } - implementation("ch.qos.logback:logback-classic") { version { require("1.2.13") } } - // CVE-2022-25857 (note: CVE-2022-1471 requires snakeyaml 2.0 which is incompatible with Spring Boot 2.7.x) - implementation("org.yaml:snakeyaml") { version { require("1.31") } } + implementation("org.springframework:spring-web") { version { require("5.3.39") } } + implementation("org.springframework:spring-webmvc") { version { require("5.3.39") } } + implementation("org.springframework:spring-expression") { version { require("5.3.39") } } + // CVE-2023-6481, CVE-2023-6378, CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225 + implementation("ch.qos.logback:logback-core") { version { require("1.5.32") } } + implementation("ch.qos.logback:logback-classic") { version { require("1.5.32") } } + // CVE-2022-25857, CVE-2022-38752, CVE-2022-41854 + // (note: CVE-2022-1471 requires snakeyaml 2.0 which is incompatible with Spring Boot 2.7.x) + implementation("org.yaml:snakeyaml") { version { require("1.32") } } } }