Pin numbus-jose-jwt to 9.37.4 (#38187)

claudevdm · web-flow · commit ac161e8d229d · 2026-04-19T10:50:25.000-04:00
diff --git a/sdks/java/io/expansion-service/build.gradle b/sdks/java/io/expansion-service/build.gradle
@@ -56,6 +56,9 @@ configurations.runtimeClasspath {
 
   // Pin zookeeper to 3.8.6 to fix CVE in transitive 3.8.4 from hadoop/hbase
   resolutionStrategy.force 'org.apache.zookeeper:zookeeper:3.8.6'
+
+  // Pin nimbus-jose-jwt to 9.37.4 to fix CVE-2025-53864 (transitive via hadoop-auth)
+  resolutionStrategy.force 'com.nimbusds:nimbus-jose-jwt:9.37.4'
 }
 
 shadowJar {

Original file line number	Diff line number	Diff line change
`@@ -56,6 +56,9 @@ configurations.runtimeClasspath {`
`56`	`56`
`57`	`57`	`// Pin zookeeper to 3.8.6 to fix CVE in transitive 3.8.4 from hadoop/hbase`
`58`	`58`	`resolutionStrategy.force 'org.apache.zookeeper:zookeeper:3.8.6'`
	`59`	`+`
	`60`	`+ // Pin nimbus-jose-jwt to 9.37.4 to fix CVE-2025-53864 (transitive via hadoop-auth)`
	`61`	`+ resolutionStrategy.force 'com.nimbusds:nimbus-jose-jwt:9.37.4'`
`59`	`62`	`}`
`60`	`63`
`61`	`64`	`shadowJar {`