From 4a3ced1592eb270e493454221e01ff8cc4273b3f Mon Sep 17 00:00:00 2001 From: Trey Chadick Date: Tue, 18 Aug 2026 09:26:10 -0700 Subject: [PATCH 1/2] Update Apache HttpClient (#1476) [CVE-2026-64607](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-64607) --- gradle.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle.properties b/gradle.properties index 6eb3bde09b..33a92cd693 100644 --- a/gradle.properties +++ b/gradle.properties @@ -185,7 +185,7 @@ hamcrestVersion=2.2 # Note: if changing this, we might need to match with the picard version in the SequenceAnalysis module build.gradle htsjdkVersion=4.3.0 -httpclient5Version=5.5.2 +httpclient5Version=5.6.4 httpcore5Version=5.4.3 # Not used directly, but these are widely used transitive dependencies From 1fa7cf92c9a1958182f402f9812bd00b2c70c1f2 Mon Sep 17 00:00:00 2001 From: Josh Eckels Date: Thu, 20 Aug 2026 17:23:35 -0700 Subject: [PATCH 2/2] Publish labkey.aws.ssm.enabled for explicit SSM opt-in (#1468) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Rationale A customer reported ERROR-level SSM logging on an on-premise server that never intended to use AWS SSM, because `SsmSecretProvider` treated any resolvable AWS credentials as a signal to activate. See the linked premiumModules PR for the full symptom. This post-processor already computes the right answer — `hasExplicitConfig` — and returns before touching the AWS SDK on-premise. It just never told the module. Publishing that decision lets CloudServices stop inferring intent from whatever credentials happen to resolve. No configuration change is needed in cloud deployments: the flag is published automatically whenever `context.awsParameterStore.prefix` or `context.awsParameterStore.secretsPrefix` is set, which cloud already does. ## Related Pull Requests - LabKey/premiumModules#688 ## Changes - Publish `labkey.aws.ssm.enabled=true` alongside the region and secrets prefix --- .../AwsParameterStoreEnvironmentPostProcessor.java | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java b/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java index dcb4bdbf1d..8cf5fb4a23 100644 --- a/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java +++ b/server/embedded/src/org/labkey/embedded/AwsParameterStoreEnvironmentPostProcessor.java @@ -4,8 +4,8 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; import org.jspecify.annotations.NonNull; -import org.springframework.boot.SpringApplication; import org.springframework.boot.EnvironmentPostProcessor; +import org.springframework.boot.SpringApplication; import org.springframework.core.Ordered; import org.springframework.core.env.ConfigurableEnvironment; import org.springframework.core.env.EnumerablePropertySource; @@ -58,8 +58,9 @@ *

SSM initialization also runs when {@code context.awsParameterStore.prefix} is explicitly * configured (even with no {@code ssm:} values), so that the CloudServices module can create its * own {@code SsmClient} for on-demand {@code SecretService} lookups. When active, this processor - * publishes {@code labkey.aws.ssm.region} and optionally {@code labkey.aws.ssm.secretsPrefix} as - * JVM system properties without any cross-classloader reflection. + * publishes {@code labkey.aws.ssm.enabled}, {@code labkey.aws.ssm.region}, and + * {@code labkey.aws.ssm.secretsPrefix} as JVM system properties without any cross-classloader + * reflection. * *

{@code context.awsParameterStore.secretsPrefix} controls where {@code SecretProperty} * values are looked up at runtime. A relative value (no leading {@code /}) is resolved against @@ -137,7 +138,7 @@ public void postProcessEnvironment(ConfigurableEnvironment environment, SpringAp secretsPrefix = prefix; } - if (!secretsPrefix.isEmpty() && !secretsPrefix.endsWith("/") && !secretsPrefix.endsWith("::")) + if (!secretsPrefix.endsWith("/") && !secretsPrefix.endsWith("::")) throw new IllegalStateException( "[LabKey AWS] Resolved secretsPrefix must end with '/' or '::' (got: '" + secretsPrefix + "'). Check " + SECRETS_PREFIX_PROPERTY + " and " + PREFIX_PROPERTY + " in application.properties"); @@ -145,8 +146,9 @@ public void postProcessEnvironment(ConfigurableEnvironment environment, SpringAp String regionOverride = environment.getProperty(REGION_PROPERTY); Region region = resolveRegion(regionOverride); - // Publish config as system properties so the CloudServices module can create its own - // SsmClient for on-demand SecretProperty lookups via SecretService at runtime. + // Publish config as system properties so the CloudServices module can create its own SsmClient + // for on-demand SecretProperty lookups via SecretService at runtime, enabled per the class-level JavaDoc + System.setProperty("labkey.aws.ssm.enabled", "true"); System.setProperty("labkey.aws.ssm.region", region.id()); System.setProperty("labkey.aws.ssm.secretsPrefix", secretsPrefix);