amaechler opened a new pull request, #20790: URL: https://github.com/apache/druid/pull/20790
### Description Some OWASP suppressions were added as a stopgap, for example while a fix was pending upstream. They never expire and often match every version, so nobody notices when they are no longer needed or when they quietly cover a newer version. This PR: - Gives temporary suppressions an expiry date using dependency-check's `until` attribute. After that date the suppression stops applying, the OWASP check fails, and someone has to look at it again. - Removes the hibernate-validator CVE-2026-93879 suppression. Master is now on 9.1.5.Final, which escapes the message parameters the CVE is about. - Adds a note at the top of the file asking for an `until` date on new temporary suppressions. Permanent suppressions (false positives, code paths Druid does not use) are unchanged. <details> <summary>Details: suppressions changed and why</summary> | Dependency | CVEs | Change | Why | | --- | --- | --- | --- | | hadoop-client-runtime 3.5.0 (shaded Jetty) | CVE-2026-5795 | Expires 2027-04-30 | Needs a Hadoop release with Jetty 9.4.59+. | | hadoop-client-runtime 3.5.0 (shaded jackson-databind) | CVE-2026-19032, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, CVE-2026-68497, CVE-2026-77310, GHSA-mhm7-754m-9p8w | Expires 2027-04-30 | Needs a Hadoop release with jackson-databind 2.18.10+. CVE-2026-68497 moved here from a block shared with parquet-jackson, whose 2.22.2 copy is already fixed. | | hadoop-client-runtime 3.5.0 (shaded jackson-core) | CVE-2026-68494 | Expires 2027-04-30, moved to its own block | Needs a Hadoop release with jackson-core 2.18.8+. Split out of a block shared with parquet-jackson so the permanent entries there do not expire too. parquet-jackson's 2.22.2 is not affected. | | hadoop-client-runtime 3.5.0 (shaded commons-configuration2) | CVE-2026-45205 | Expires 2027-04-30 | Needs a Hadoop release with commons-configuration2 2.15.0+. | | hibernate-validator | CVE-2026-93879 | Removed | 9.1.5.Final (#20765) escapes message parameters by default (HV-2256), which addresses the issue described in Red Hat bug 2540892. | The Hadoop dates are about 6 months out because we depend on a Hadoop release. Suppressions where Druid itself just needs to upgrade should use about 3 months. Once a date passes, the OWASP check fails on master, on release branches and in the `apache-release` build, until the entry is removed or renewed. </details> <hr> This PR has: - [x] been self-reviewed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
