wank125 opened a new pull request, #18720: URL: https://github.com/apache/dolphinscheduler/pull/18720
## Was this PR generated or assisted by AI? YES. The version analysis, compatibility verification (CVE fixed versions, Java 8 bytecode checks), tests and this description were prepared with an AI coding agent under my direction, and I reviewed the change. ## Purpose of the pull request The OWASP Dependency Check job (runs on every PR touching a pom.xml, `failBuildOnCVSS=7`) flags a large set of aging dependencies and has been failing continuously. This PR bumps three standalone client libraries whose CVEs are actively flagged in the report, while staying within the project's Java 8 baseline and avoiding any framework-line changes: | dependency | from | to | fixes | |---|---|---|---| | ch.qos.logback:logback-classic/core | 1.2.11 | **1.2.13** | CVE-2023-6378 (CVSS 7.1) — 1.2.13 is the official fix for the 1.2 line per [GHSA-vmq6-5m68-f53m](https://github.com/advisories/GHSA-vmq6-5m68-f53m) | | org.postgresql:postgresql | 42.4.4 | **42.7.14** | CVE-2026-42198 (fixed since 42.7.11) plus the accumulated 42.5.x–42.7.x security fixes | | net.snowflake:snowflake-jdbc | 3.13.29 | **3.28.0** | CVE-2025-24789 (fixed since 3.22.0) | Version ceiling rationale: - **logback stays on 1.2.x**: 1.3+ requires slf4j 2.x while the project binds slf4j 1.7, so 1.2.13 is the newest safe release on the current logging stack. - **snowflake-jdbc stops at 3.28.0**: verified to be the last release whose jars ship Java 8 bytecode (class file major 52); the 4.x line requires a newer JDK. The `dolphinscheduler-datasource-snowflake` plugin declares the driver without importing any `net.snowflake` class, so this is a drop-in driver update. - All three target jars were verified to run on Java 8. ## Brief change log - `dolphinscheduler-bom/pom.xml`: bump `logback.version`, `postgresql.version` and `snowflake-jdbc.version` (3 property lines, no other change). ## Verify this pull request Manually verified the change by running, on JDK 8: - `mvn -pl dolphinscheduler-bom,dolphinscheduler-common,<task-api, datasource-postgresql, datasource-snowflake, dao-postgresql, registry-jdbc, tools with -am> test` — all unit tests of the affected modules pass, including the logback-based components in `dolphinscheduler-common`/`dolphinscheduler-task-api` and the registry-jdbc tests running against the new postgresql driver. - `spotless:check` passes; resolved versions confirmed via `dependency:tree` (1.2.13 / 42.7.14 / 3.28.0). - Note on pre-existing failures seen locally (identical with and without this change, i.e. not introduced here): the `dolphinscheduler-tools` postgres integration tests fail on dev because the postgresql test profile is wired to a `jdbc:mysql://` URL, and `dolphinscheduler-storage-s3` tests cannot pull the removed `minio/minio:RELEASE.2023-09-04T19-57-37Z` image. ## Pull Request Notice This PR intentionally does **not** bump snakeyaml (CVE-2022-1471 needs the 2.x line which is incompatible with Spring Boot 2.x) or zookeeper/jetty/snappy/protobuf (pinned by hadoop/curator alignment) — those need a coordinated upgrade beyond a safe patch-level bump. Also note this PR will not turn the OWASP job green on its own (many other ≥CVSS-7 flags remain, e.g. spring 5.3.x / jetty 9.4.x); it removes the three flags that can be cleared with zero-risk, Java-8-compatible bumps. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
