Purushottam Sinha created FLINK-41113:
-----------------------------------------
Summary: Connectors/Pulsar: Bump dependency versions with known
advisories in the root pom
Key: FLINK-41113
URL: https://issues.apache.org/jira/browse/FLINK-41113
Project: Flink
Issue Type: Improvement
Components: Connectors / Pulsar
Reporter: Purushottam Sinha
Bump dependencies in the root {{pom.xml}} that have known advisories in the
resolved tree (checked against OSV on {{main}}, Pulsar 4.0.14 / Flink 2.0.2).
Nothing bundled into {{flink-sql-connector-pulsar}} is affected; everything
below is {{provided}} or test scope.
*Bumped:*
* {{jackson-bom}} 2.22.2 -> 2.22.4 (provided, optional via Pulsar). 4 HIGH
advisories (CVE-2026-89425, CVE-2026-89407, CVE-2026-91777, CVE-2026-91776),
fixed in 2.22.3.
* {{log4j}} 2.17.2 -> 2.26.1 (test). 4 MODERATE.
* {{assertj}} 3.23.1 -> 3.27.7 (test). HIGH XXE, CVE-2026-24400.
*Pinned (test scope, pulled in by {{curator-test}} 5.4.0):*
* {{zookeeper}} 3.7.1 -> 3.7.2. CRITICAL CVE-2023-44981.
* {{netty}} 4.1.76 -> 4.1.137.Final via {{netty-bom}}. Includes CRITICAL
CVE-2026-75595.
* {{guava}} 31.1-jre -> 33.4.8-jre.
*Left unchanged:*
* {{lz4-java}} 1.10.3 and {{commons-lang3}} 3.14.0: supplied by Flink as
{{provided}}, so pinning here would not change what a cluster runs.
* {{zookeeper}} 3.7.2 still has one moderate advisory (CVE-2024-23944, fixed in
3.8.4+); that needs a larger {{curator-test}} jump.
* Advisories inside libraries shaded into {{pulsar-client-all}} are not visible
to dependency scanning and depend on Pulsar releases.
*Verified:* {{-Pcheck-convergence}} passes, 196 unit tests and 26 e2e tests
pass.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
