Releases: cloudfoundry/java-buildpack
Releases · cloudfoundry/java-buildpack
Java Buildpack v4.48.2
I'm pleased to announce the release of the java-buildpack, version 4.48.2. This release is a dependency update-only release. It primarily bumps Apache Tomcat which includes a mitigation for CVE-2022-22965 a Spring Framework vulnerability.
For a more detailed look at the changes in 4.48.2, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 22.3.0_33637 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 22.3.0_26 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.11.0_25821 |
Release Notes | |
| Datadog APM Javaagent | 0.98.1 |
Release Notes | |
| Elastic APM Agent | 1.30.0 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.12.5 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.16 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2022.1.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.5.0 |
Release Notes | |
| OpenJDK JRE | 1.8.0_322 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.14_9 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.2_9 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.3 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2079 |
||
| SkyWalking | 8.9.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.6 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.64.2 |
Release Notes | |
| Tomcat | 9.0.62 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2022.3.96 |
Release Notes |
Dependency Notes
None
Java Buildpack v4.48.1
I'm pleased to announce the release of the java-buildpack, version 4.48.1. This release is a dependency update-only release. It primarily bumps Apache Tomcat and Geode Tomcat session store, the latter of which fixes a critical NullPointerException bug.
For a more detailed look at the changes in 4.48.1, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 22.2.0_33545 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.9.1_25108 |
Release Notes | |
| Datadog APM Javaagent | 0.96.0 |
Release Notes | |
| Elastic APM Agent | 1.29.0 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.12.5 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.16 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2022.1.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.5.0 |
Release Notes | |
| OpenJDK JRE | 1.8.0_322 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.14_9 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.2_9 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.3 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2070 |
||
| SkyWalking | 8.9.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.4 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.64.2 |
Release Notes | |
| Tomcat | 9.0.59 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.227 |
Release Notes |
Dependency Notes
None
Java Buildpack v4.48
I'm pleased to announce the release of the java-buildpack, version 4.48. This release focuses on dependency updates, primarily the latest Java/OpenJDK quarterly updates.
Other notable changes:
- We have bumped the Apache SkyWalking version to 8.8.0. This is the latest supported version at the time of publishing. Please be aware of this change if you are using the Apache SkyWalking agent as this is a major version increase.
- #926 resolves a classpath problem when using the Luna Security Provider on Java 9+.
- This release pulls in new versions of App Dynamic and New Relic that include patches for CVE-2021-44832.
For a more detailed look at the changes in 4.48, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.11.4_33358 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.9.0_24156 |
Release Notes | |
| Datadog APM Javaagent | 0.93.0 |
Release Notes | |
| Elastic APM Agent | 1.28.4 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.12.4 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2022.1.0 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.5.0 |
Release Notes | |
| OpenJDK JRE | 1.8.0_322 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.14_9 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.2_9 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.1 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2056 |
||
| SkyWalking | 8.8.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.3 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.64.2 |
Release Notes | |
| Tomcat | 9.0.58 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.225 |
Release Notes |
Dependency Notes
- This version brings in new versions of the JVM released by the OpenJDK project. These are quarterly updates that bring in bug and security fixes. We recommend that everyone read the linked release notes for the versions of the JVM you are consuming in preparation for upgrading buildpacks.
Java Buildpack v4.47
v4.47
This tag was signed with the committer’s verified signature.
pivotal-david-osullivan
David O'Sullivan
132ca89
This commit was signed with the committer’s verified signature.
pivotal-david-osullivan
David O'Sullivan
I'm pleased to announce the release of the java-buildpack, version 4.47. This release focuses on dependency updates, primarily that fix the latest Apache Log4j2 vulnerability, CVE-2021-45105, in dependencies used by the Java buildpack.
In particular, the following dependencies have been updated to include Log4j 2.17.0 and have been patched in this release:
- AppDynamics Java Agent (21.11.3)
- New Relic Java Agent (7.4.3)
If you are using an online version of the Java buildpack you do not strictly need this update, as the online buildpack will always pick the latest version of dependencies.
For a more detailed look at the changes in 4.47, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.11.3_33314 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.9.0_23825 |
Release Notes | |
| Datadog APM Javaagent | 0.92.0 |
Release Notes | |
| Elastic APM Agent | 1.28.2 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.12.4 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2021.4.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.4.3 |
Release Notes | |
| OpenJDK JRE | 1.8.0_312 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.13_8 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.1_12 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.1 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2056 |
||
| SkyWalking | 6.6.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.1 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.64.2 |
Release Notes | |
| Tomcat | 9.0.56 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.221 |
Release Notes |
Dependency Notes
- Elastic APM have announced that their Java agent is not vulnerable to CVE-2021-45105
- The Geode Tomcat Session Store dependency is also not vulnerable due to the specific configuration required.
- Thales (formerly Gemalto) ProtectApp has not released an update with patches for either CVE-2021-44228, CVE-2021-45046 & CVE-2021-45105. We have contacted the vendor to request one and are awaiting a fix. Because this needs to come from a 3rd party vendor we cannot provide a timeline for when this will happen. If you are using ProtectApp and have a support contract with the vendor, we suggest you file a ticket and also request a patch.
Java Buildpack v4.46
v4.46
This tag was signed with the committer’s verified signature.
pivotal-david-osullivan
David O'Sullivan
9ada852
This commit was signed with the committer’s verified signature.
pivotal-david-osullivan
David O'Sullivan
I'm pleased to announce the release of the java-buildpack, version 4.46. This release focuses on dependency updates, primarily that fix the latest Apache Log4j2 vulnerability, CVE-2021-45046, in dependencies used by the Java buildpack.
Updated dependencies include:
- Elastic APM Agent 1.28.2
- Contrast Security Agent 3.9.0_23825
In particular, the following dependencies were known to be vulnerable to CVE-2021-45046 & have been patched in this release:
- Geode Tomcat Session Store 1.12.4
If you are using an online version of the Java buildpack you do not strictly need this update, as the online buildpack will always pick the latest version of dependencies.
For a more detailed look at the changes in 4.46, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.11.2_33305 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.9.0_23825 |
Release Notes | |
| Datadog APM Javaagent | 0.92.0 |
Release Notes | |
| Elastic APM Agent | 1.28.2 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.12.4 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2021.4.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.4.2 |
Release Notes | |
| OpenJDK JRE | 1.8.0_312 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.13_8 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.1_12 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.1 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2056 |
||
| SkyWalking | 6.6.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.1 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.64.2 |
Release Notes | |
| Tomcat | 9.0.56 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.221 |
Release Notes |
Dependency Notes
- Thales (formerly Gemalto) ProtectApp has not released an update with patches for either CVE-2021-44228 or CVE-2021-45046. We have contacted the vendor to request one and are awaiting a fix. Because this needs to come from a 3rd party vendor we cannot provide a timeline for when this will happen. If you are using ProtectApp and have a support contract with the vendor, we suggest you file a ticket and also request a patch.
Java Buildpack v4.45
v4.45
This tag was signed with the committer’s verified signature.
pivotal-david-osullivan
David O'Sullivan
f1b695a
This commit was signed with the committer’s verified signature.
pivotal-david-osullivan
David O'Sullivan
I'm pleased to announce the release of the java-buildpack, version 4.45. This release focuses on dependency updates, primarily that fix the latest Apache Log4j2 vulnerability, CVE-2021-45046, in dependencies used by the Java buildpack.
- In particular, the following dependencies were known to be vulnerable to CVE-2021-45046 & have been patched in this release:
- AppDynamics Java Agent
- New Relic Java Agent
If you are using an online version of the Java buildpack you do not strictly need this update, as the online buildpack will always pick the latest version of dependencies.
For a more detailed look at the changes in 4.45, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.11.2_33305 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.9.0_23766 |
Release Notes | |
| Datadog APM Javaagent | 0.91.0 |
Release Notes | |
| Elastic APM Agent | 1.28.1 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.13.4 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2021.4.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.4.2 |
Release Notes | |
| OpenJDK JRE | 1.8.0_312 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.13_8 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.1_12 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.1 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2056 |
||
| SkyWalking | 6.6.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.1 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.64.2 |
Release Notes | |
| Tomcat | 9.0.56 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.221 |
Release Notes |
Dependency Notes
- Elastic APM Agent release was updated to version 1.28.1 in the previous Java Buildpack release 4.44. This version contains a fix which covers both CVE-2021-44228 & CVE-2021-45046
- Thales ProtectApp has not released an update with patches for either CVE-2021-44228 or CVE-2021-45046. We have contacted the vendor to request one and are awaiting a fix. Because this needs to come from a 3rd party vendor we cannot provide a timeline for when this will happen. If you are using ProtectApp and have a support contract with the vendor, we suggest you file a ticket and also request a patch.
- A release for the Geode Session store that can be used with Tomcat to resolve CVE-2021-45046 is pending. We are in contact with the development team and are awaiting a release with the fix. As soon as this is available, we'll be cutting a new release of the Java buildpack with that fix.
Java Buildpack v4.44
I'm pleased to announce the release of the java-buildpack, version 4.44. This release focuses on dependency updates, primarily that fix the Apache Log4j2 vulnerability, CVE-2021-44228, in dependencies used by the Java buildpack.
- Fixed case in networkzone query parameter (@arthfl via #915)
- In particular, the following dependencies were known to be vulnerable to CVE-2021-44228 & have been patched in this release:
- AppDynamics Java Agent
- Elastic APM Java Agent
- New Relic Java Agent
- Geode Tomcat Session Store
If you are using an online version of the Java buildpack you do not strictly need this update, as the online buildpack will always pick the latest version of dependencies.
For a more detailed look at the changes in 4.44, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.11.1_33280 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 21.11.0_20 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.8.11_23624 |
Release Notes | |
| Datadog APM Javaagent | 0.91.0 |
Release Notes | |
| Elastic APM Agent | 1.28.1 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.13.4 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2021.4.2 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.4.1 |
Release Notes | |
| OpenJDK JRE | 1.8.0_312 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.13_8 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.1_12 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.1 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2056 |
||
| SkyWalking | 6.6.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.6.1 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.63.0 |
Release Notes | |
| Tomcat | 9.0.56 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.11.221 |
Release Notes |
Dependency Notes
- The buildpack is shipping Geode Tomcat Session Store
1.13.4, which uses Apache Geode1.13.5and contains a fix for the Apache Log4j2 vulnerability, CVE-2021-44228. - This version of the buildpack should not be used as it only contains partial fixes for the Log4j2 vulnerabilities. This version includes patches for CVE-2021-44228 for affected 3rd party dependencies (the buildpack itself is not impacted at all) but it does not include patches for CVE-2021-45046. You need version 4.45 of the Java buildpack to be completely patched.
Contributors
arthfl
Assets 3
Java Buildpack v4.43
I'm pleased to announce the release of the java-buildpack, version 4.43. This release focuses on bug fixes, including new Java quarterly updates for versions 8, 11, and 17.
- Relax escaping of values to enable limited access to the shell for AppDynamnics config (#911)
- Version matcher now prefers a specific match over a partial match (#907)
- Shell escape the value of Elastic APM custom properties (#908)
- Modify default Tomcat configuration to include HTTP/2 support (#906)
- Rename framework-seeker-security-provider.md (via @mureinik #910)
- Notable updated Dependencies
- Java Quarterly Updates Oct 2021
- Apache Tomcat 9.0.54 which resolves CVE-2021-42340
For a more detailed look at the changes in 4.43, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.10.0_33144 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
||
| CA Introscope APM Framework | 21.6.0_28 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.8.9_22663 |
Release Notes | |
| Datadog APM Javaagent | 0.89.0 |
Release Notes | |
| Elastic APM Agent | 1.26.0 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.11.0 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.15 |
Release Notes | |
| JaCoCo Agent | 0.8.7 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 11.1.4 |
ChangeLog | |
| JRebel Agent | 2021.4.0 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.3.0 |
Release Notes | |
| OpenJDK JRE | 1.8.0_312 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.13_8 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.1_12 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.0 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.1995 |
||
| SkyWalking | 6.6.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.5.6 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.63.0 |
Release Notes | |
| Tomcat | 9.0.54 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.3.233 |
Release Notes |
Contributors
mureinik
Assets 3
Java Buildpack v4.42
I'm pleased to announce the release of the java-buildpack, version 4.42. This release focuses on Java version updates.
- Adds support for Java 17
- Removes support for Java 16 which goes EOGS at the end of 9/2021.
- Bumps versions of Metrics Writer, Auto Reconfiguration, and Container Security Provider to pick up dependency updates that address vulnerabilities in those dependencies. See the linked PRs for details.
For a more detailed look at the changes in 4.42, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 21.8.0_32958 |
||
| Azure Application Insights Agent | 2.6.2 |
||
| CA Introscope APM Framework | 21.6.0_28 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.8.8_22125 |
||
| Datadog APM Javaagent | 0.87.0 |
||
| Elastic APM Agent | 1.26.0 |
||
| Gemalto Luna Security Provider | 7.4.0 |
||
| Gemalto ProtectApp Security Provider | 8.4.0 |
||
| Geode Tomcat Session Store | 1.11.0 |
||
| Google Stackdriver Debugger | 2.29.0 |
||
| Google Stackdriver Profiler | 0.1.0 |
||
| Groovy | 2.5.15 |
||
| JaCoCo Agent | 0.8.7 |
||
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 11.1.4 |
||
| JRebel Agent | 2021.3.2 |
||
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
||
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.2.0 |
||
| OpenJDK JRE | 1.8.0_302 |
link | link |
| OpenJDK JRE 11 | 11.0.12_7 |
link | link |
| OpenJDK JRE 17 | 17.0.0_35 |
link | link |
| PostgreSQL JDBC Driver | 42.2.23 |
||
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.1968 |
||
| SkyWalking | 6.6.0 |
||
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.5.4 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Takipi Agent | 4.62.0 |
||
| Tomcat | 9.0.53 |
link | link |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2021.3.231 |
Not Available | link |
Java Buildpack v4.41
I'm pleased to announce the release of the java-buildpack, version 4.41. This release focuses on quarterly JDK updates and bug fixes.
- Ensures compatibility with older and newer DataDog buildpacks. #898
- Includes OpenJDK JRE version
16.0.2_7
For a more detailed look at the changes in 4.41, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Packaged Dependencies
| Dependency | Version |
|---|---|
| AppDynamics Agent | 21.6.1_32843 |
| Azure Application Insights Agent | 2.6.2 |
| CA Introscope APM Framework | 21.6.0_28 |
| Client Certificate Mapper | 1.11.0_RELEASE |
| Container Security Provider | 1.18.0_RELEASE |
| Contrast Security Agent | 3.8.6_21068 |
| Datadog APM Javaagent | 0.83.2 |
| Elastic APM Agent | 1.25.0 |
| Gemalto Luna Security Provider | 7.4.0 |
| Gemalto ProtectApp Security Provider | 8.4.0 |
| Geode Tomcat Session Store | 1.11.0 |
| Google Stackdriver Debugger | 2.29.0 |
| Google Stackdriver Profiler | 0.1.0 |
| Groovy | 2.5.9 |
| JaCoCo Agent | 0.8.7 |
| Java Memory Assistant Agent | 0.5.0 |
| Java Memory Assistant Clean Up | 0.1.0 |
| JProfiler Profiler | 11.1.4 |
| JRebel Agent | 2021.3.0 |
| jvmkill Agent | 1.16.0_RELEASE |
| MariaDB JDBC Driver | 2.7.2 |
| Memory Calculator | 3.13.0_RELEASE |
| Metric Writer | 3.4.0_RELEASE |
| New Relic Agent | 7.1.1 |
| OpenJDK JRE | 1.8.0_302 |
| OpenJDK JRE 11 | 11.0.12_7 |
| OpenJDK JRE 16 | 16.0.2_7 |
| PostgreSQL JDBC Driver | 42.2.23 |
| Redis Session Store | 1.3.6_RELEASE |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
| SeaLights Agent | 3.1.1956 |
| SkyWalking | 6.6.0 |
| Spring Auto-reconfiguration | 2.11.0_RELEASE |
| Spring Boot CLI | 2.5.3 |
| Spring Boot Container Customizer | 2.6.0_RELEASE |
| Takipi Agent | 4.49.1 |
| Tomcat | 9.0.50 |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
| Tomcat Logging Support | 3.3.0_RELEASE |
| YourKit Profiler | 2021.3.231 |