[GEODE-10628] Remediation of CVE-2026-59296

boms/geode-all-bom/src/test/resources/expected-pom.xml

@@ -195,7 +195,7 @@
       <dependency>
         <groupId>io.micrometer</groupId>
         <artifactId>micrometer-core</artifactId>
-        <version>1.9.0</version>
+        <version>1.16.7</version>
       </dependency>
       <dependency>
         <groupId>io.swagger.core.v3</groupId>

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -40,7 +40,7 @@ class DependencyConstraints {
     deps.put("javax.transaction-api.version", "1.3")
     deps.put("jgroups.version", "3.6.20.Final")
     deps.put("log4j.version", "2.25.5")
-    deps.put("micrometer.version", "1.9.1")
+    deps.put("micrometer.version", "1.16.7")
     deps.put("shiro.version", "1.13.0")
     deps.put("slf4j-api.version", "1.7.36")
     deps.put("jboss-modules.version", "1.11.0.Final")

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -963,7 +963,7 @@ javadoc/package-list
 javadoc/script.js
 javadoc/serialized-form.html
 javadoc/stylesheet.css
-lib/HdrHistogram-2.1.12.jar
+lib/HdrHistogram-2.2.2.jar
 lib/HikariCP-4.0.3.jar
 lib/LatencyUtils-2.0.3.jar
 lib/antlr-2.7.7.jar
@@ -1031,6 +1031,7 @@ lib/jna-5.11.0.jar
 lib/jna-platform-5.11.0.jar
 lib/joda-time-2.12.7.jar
 lib/jopt-simple-5.0.4.jar
+lib/jspecify-1.0.1.jar
 lib/log4j-api-2.25.5.jar
 lib/log4j-core-2.25.5.jar
 lib/log4j-jcl-2.25.5.jar
@@ -1041,7 +1042,9 @@ lib/lucene-analyzers-phonetic-6.6.6.jar
 lib/lucene-core-6.6.6.jar
 lib/lucene-queries-6.6.6.jar
 lib/lucene-queryparser-6.6.6.jar
-lib/micrometer-core-1.9.0.jar
+lib/micrometer-commons-1.16.7.jar
+lib/micrometer-core-1.16.7.jar
+lib/micrometer-observation-1.16.7.jar
 lib/mx4j-3.0.2.jar
 lib/mx4j-remote-3.0.2.jar
 lib/mx4j-tools-3.0.1.jar

geode-assembly/src/integrationTest/resources/expected_jars.txt

@@ -56,6 +56,7 @@ joda-time
 jopt-simple
 json-path
 json-smart
+jspecify
 lang-tag
 log4j-api
 log4j-core
@@ -67,7 +68,9 @@ lucene-analyzers-phonetic
 lucene-core
 lucene-queries
 lucene-queryparser
+micrometer-commons
 micrometer-core
+micrometer-observation
 mx4j
 mx4j-remote
 mx4j-tools

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -56,7 +56,7 @@ commons-digester-2.1.jar
 commons-io-2.11.0.jar
 commons-logging-1.2.jar
 classgraph-4.8.146.jar
-micrometer-core-1.9.0.jar
+micrometer-core-1.16.7.jar
 fastutil-8.5.8.jar
 javax.resource-api-1.7.1.jar
 jetty-webapp-9.4.57.v20241219.jar
@@ -82,7 +82,10 @@ javax.activation-api-1.2.0.jar
 jline-2.12.jar
 lucene-queries-6.6.6.jar
 spring-jcl-5.3.20.jar
-HdrHistogram-2.1.12.jar
+micrometer-commons-1.16.7.jar
+micrometer-observation-1.16.7.jar
+jspecify-1.0.1.jar
+HdrHistogram-2.2.2.jar
 LatencyUtils-2.0.3.jar
 javax.transaction-api-1.3.jar
 jetty-xml-9.4.57.v20241219.jar

geode-core/src/main/java/org/apache/geode/metrics/internal/NoopMeterRegistry.java

@@ -39,13 +39,13 @@
 import io.micrometer.core.instrument.noop.NoopLongTaskTimer;
 import io.micrometer.core.instrument.noop.NoopMeter;
 import io.micrometer.core.instrument.noop.NoopTimer;
-import io.micrometer.core.lang.NonNullApi;
-import io.micrometer.core.lang.Nullable;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 import org.apache.geode.annotations.Immutable;
 import org.apache.geode.annotations.VisibleForTesting;
 
-@NonNullApi
+@NullMarked
 public class NoopMeterRegistry extends MeterRegistry {
 
   @Immutable

geode-gfsh/src/main/java/org/apache/geode/management/internal/cli/commands/lifecycle/StopServerCommand.java

@@ -14,7 +14,7 @@
  */
 package org.apache.geode.management.internal.cli.commands.lifecycle;
 
-import static io.micrometer.core.instrument.util.StringUtils.isNotBlank;
+import static org.apache.commons.lang3.StringUtils.isNotBlank;
 import static org.apache.geode.management.internal.cli.shell.MXBeanProvider.getMemberMXBean;
 
 import java.util.concurrent.TimeUnit;

geode-server-all/src/integrationTest/resources/dependency_classpath.txt

@@ -70,9 +70,12 @@ spring-shell-1.2.0.RELEASE.jar
 jaxb-impl-2.3.2.jar
 jna-platform-5.11.0.jar
 log4j-jul-2.25.5.jar
-HdrHistogram-2.1.12.jar
+HdrHistogram-2.2.2.jar
 jackson-annotations-2.21.jar
-micrometer-core-1.9.1.jar
+micrometer-commons-1.16.7.jar
+micrometer-core-1.16.7.jar
+micrometer-observation-1.16.7.jar
+jspecify-1.0.1.jar
 shiro-config-ogdl-1.13.0.jar
 geode-log4j-0.0.0.jar
 lucene-analyzers-phonetic-6.6.6.jar