[
https://issues.apache.org/jira/browse/FLINK-41113?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated FLINK-41113:
-----------------------------------
Labels: pull-request-available (was: )
> Connectors/Pulsar: Bump dependency versions with known advisories in the root
> pom
> ---------------------------------------------------------------------------------
>
> Key: FLINK-41113
> URL: https://issues.apache.org/jira/browse/FLINK-41113
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Pulsar
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> Bump dependencies in the root {{pom.xml}} that have known advisories in the
> resolved tree (checked against OSV on {{main}}, Pulsar 4.0.14 / Flink 2.0.2).
> Nothing bundled into {{flink-sql-connector-pulsar}} is affected; everything
> below is {{provided}} or test scope.
> *Bumped:*
> * {{jackson-bom}} 2.22.2 -> 2.22.4 (provided, optional via Pulsar). 4 HIGH
> advisories (CVE-2026-89425, CVE-2026-89407, CVE-2026-91777, CVE-2026-91776),
> fixed in 2.22.3.
> * {{log4j}} 2.17.2 -> 2.26.1 (test). 4 MODERATE.
> * {{assertj}} 3.23.1 -> 3.27.7 (test). HIGH XXE, CVE-2026-24400.
> *Pinned (test scope, pulled in by {{curator-test}} 5.4.0):*
> * {{zookeeper}} 3.7.1 -> 3.7.2. CRITICAL CVE-2023-44981.
> * {{netty}} 4.1.76 -> 4.1.137.Final via {{netty-bom}}. Includes CRITICAL
> CVE-2026-75595.
> * {{guava}} 31.1-jre -> 33.4.8-jre.
> *Left unchanged:*
> * {{lz4-java}} 1.10.3 and {{commons-lang3}} 3.14.0: supplied by Flink as
> {{provided}}, so pinning here would not change what a cluster runs.
> * {{zookeeper}} 3.7.2 still has one moderate advisory (CVE-2024-23944, fixed
> in 3.8.4+); that needs a larger {{curator-test}} jump.
> * Advisories inside libraries shaded into {{pulsar-client-all}} are not
> visible to dependency scanning and depend on Pulsar releases.
> *Verified:* {{-Pcheck-convergence}} passes, 196 unit tests and 26 e2e tests
> pass.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
