I noticed jakarta.mail dependency downgraded from 1.6.8( in 8.18.6 )to 1.6.3 (in 8.19.20)
runtimeOnly "com.nimbusds:content-type:2.3"
api project(path: xpackModule('security:lib:nimbus-jose-jwt-modified'), configuration: 'shadow')
if (isEclipse) {
/*
* Eclipse can't pick up the shadow dependency so we point it at the unmodified version of the library
* so it can compile things.
*/
api "com.nimbusds:nimbus-jose-jwt:10.0.2"
}
api "com.nimbusds:lang-tag:1.7"
api "com.sun.mail:jakarta.mail:1.6.8"
api "net.jcip:jcip-annotations:1.0"
api "net.minidev:json-smart:2.5.2"
api "net.minidev:accessors-smart:2.5.2"
api "org.ow2.asm:asm:9.7.1"
testImplementation "org.elasticsearch:mocksocket:${versions.mocksocket}"
// Test dependencies for Kerberos (MiniKdc)
testImplementation('commons-io:commons-io:2.5')
testImplementation('org.apache.kerby:kerb-simplekdc:1.1.1')
We were tracking the CVE CVE-2025-7962 internally and was wondering if this downgrade made it open it again
I don't think it was downgraded. It just looks like an oversight that it was backported to 8.18 but not 8.19. bump Jakarta Mail by ankit--sethi · Pull Request #133240 · elastic/elasticsearch · GitHub . The change needs to be ported to 8.19.
It was indeed an oversight.
PR elasticsearch#158317 just merged with the Jakarta Mail 1.6.8 version bump.
It will be included in the upcoming 8.19.22 release.