[CVE-2026-24400] Upgrade assertj-core to 3.27.7 by RyanL1997 · Pull Request #5100 · opensearch-project/sql

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:16:51Z

Description

[CVE] Upgrade assertj-core to 3.27.7

Related Issues

Resolve https://advisories.opensearch.org/advisory/CVE-2026-24400

Check List

New functionality includes testing.
New functionality has been documented.
New functionality has javadoc added.
New functionality has a user manual doc added.
New PPL command checklist all confirmed.
API changes companion pull request created.
Commits are signed per the DCO using --signoff or -s.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

coderabbitai · 2026-02-02T19:17:13Z

📝 Walkthrough

Walkthrough

Updates AssertJ test dependency from 3.9.1 to 3.27.7 and adds a corresponding maintenance note in the 3.5.0.0 release notes. No functional code or public API changes.

Changes

Cohort / File(s)	Summary
Dependency Version Update `common/build.gradle`	Bumps `org.assertj:assertj-core` test dependency from `3.9.1` to `3.27.7`.
Release Notes `release-notes/opensearch-sql.release-notes-3.5.0.0.md`	Adds a Maintenance entry documenting the AssertJ upgrade (`[`#5100`]`).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

opensearch-project/sql#5092 — also updates the 3.5 release notes with the AssertJ 3.27.7 maintenance entry.

Suggested labels

maintenance

Suggested reviewers

ps48
kavithacm
derek-ho
penghuo
qianheng-aws

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the CVE upgrade, referencing the related security advisory, and providing a properly formatted checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title directly and specifically addresses the main change: upgrading assertj-core to 3.27.7 to resolve CVE-2026-24400, which is confirmed by both the file summaries and PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 · 2026-02-02T19:51:20Z

Some of the CI tasks has been cancelled by github, will ltrigger the re-run.

RyanL1997 · 2026-02-02T20:33:03Z

All this CI tasks has been stucked at:

Job is waiting for a hosted runner to come online.
Evaluating security-it-linux.if
Evaluating: success()
Result: true
Job is about to start running on the hosted runner: GitHub Actions 1001943859
Requested labels: ubuntu-latest
Job defined at: opensearch-project/sql/.github/workflows/integ-tests-with-security.yml@refs/pull/5100/merge
Waiting for a runner to pick up this job...

RyanL1997 · 2026-02-02T21:03:14Z

I have also confirmed with @rishabh6788 that we dont need to include this into the 3.5 release + this is a test related dependency. So im reverting the release note change and no backport needed as for now.

Also had a conversation with @peterzhuamazon, and it is actually better if we can fix this cve at current 3.5 release.

RyanL1997 · 2026-02-02T21:09:56Z

The above CI error is due to the ongoing GHA outage : https://www.githubstatus.com/

opensearch-trigger-bot · 2026-02-03T06:13:41Z

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repositorycd$(git rev-parse --show-toplevel)# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working treepushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5100-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 a1bb9ba652b1d70c9315eb61170b6c29efd9fd5d
# Push it to GitHub
git push --set-upstream origin backport/backport-5100-to-2.19-dev
# Go back to the original working treepopd# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5100-to-2.19-dev.

) * [CVE] Upgrade assertj-core to 3.27.7 Signed-off-by: Jialiang Liang <jiallian@amazon.com> * update release not of 3.5 Signed-off-by: Jialiang Liang <jiallian@amazon.com> --------- Signed-off-by: Jialiang Liang <jiallian@amazon.com>

[CVE] Upgrade assertj-core to 3.27.7
03bc25c
Signed-off-by: Jialiang Liang <jiallian@amazon.com>

update release not of 3.5
e4b4e42
Signed-off-by: Jialiang Liang <jiallian@amazon.com>

RyanL1997 added the maintenance Improves code quality, but not the product label Feb 2, 2026

dai-chen previously approved these changes Feb 2, 2026
View reviewed changes

RyanL1997 dismissed dai-chen’s stale review via 2241c9aFebruary 2, 2026 20:55

RyanL1997 changed the title ~~[CVE] Upgrade assertj-core to 3.27.7~~[CVE-2026-24400] Upgrade assertj-core to 3.27.7Feb 2, 2026

RyanL1997 mentioned this pull request Feb 2, 2026
[Backport 3.5][CVE-2026-24400] Upgrade assertj-core to 3.27.7 #5102
Merged
8 tasks

RyanL1997 force-pushed the cve-350-assertj-core branch from 2241c9a to e4b4e42Compare February 2, 2026 22:07

LantaoJin approved these changes Feb 3, 2026
View reviewed changes

LantaoJin added the backport 2.19-dev label Feb 3, 2026

qianheng-aws approved these changes Feb 3, 2026
View reviewed changes

qianheng-aws merged commit a1bb9ba into opensearch-project:mainFeb 3, 2026
114 of 155 checks passed

opensearch-trigger-botBot added the backport-failed label Feb 3, 2026

dai-chen mentioned this pull request Mar 31, 2026
[CVE-2026-24400] Bump assertj-core from 3.9.1 to 3.27.7 #5294
Merged
8 tasks