spuru9 opened a new pull request, #131: URL: https://github.com/apache/flink-connector-pulsar/pull/131
## Purpose of the change Clears known advisories in the resolved dependency tree (checked against OSV on `main`). Nothing bundled into `flink-sql-connector-pulsar` is affected; all of these are `provided` or test scope, so this mainly keeps the build and test JVM clean. ## Brief change log | Dep | From | To | Scope | |---|---|---|---| | `jackson-bom` | 2.22.2 | 2.22.4 | provided (optional via Pulsar). 4 HIGH advisories (CVE-2026-89425, -89407, -91777, -91776), fixed in 2.22.3 | | `log4j` | 2.17.2 | 2.26.1 | test, 4 MODERATE | | `assertj` | 3.23.1 | 3.27.7 | test, HIGH XXE (CVE-2026-24400) | | `zookeeper` (new pin) | 3.7.1 | 3.7.2 | test via `curator-test`, CRITICAL CVE-2023-44981 | | `netty-bom` (new import) | 4.1.76 | 4.1.137.Final | test via `curator-test`, incl. CRITICAL CVE-2026-75595 | | `guava` (new pin) | 31.1-jre | 33.4.8-jre | test via `curator-test` | Not changed: `lz4-java` 1.10.3 and `commons-lang3` 3.14.0 are supplied by Flink as `provided`; pinning here would not change what a cluster runs. `zookeeper` 3.7.2 still has one moderate advisory (CVE-2024-23944, fixed in 3.8.4+), which needs a larger `curator-test` jump. ## Verifying this change - `mvn package -DskipTests -Pcheck-convergence` passes on all modules. - `flink-connector-pulsar` unit tests: 196 run, 0 failures, 1 skipped. - `flink-connector-pulsar-e2e-tests` (`-Prun-end-to-end-tests`, Flink 2.0.2 dist): 26 run, 0 failures. - Re-scan of the resolved tree: only the three items above remain. ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): yes - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no ## Documentation - Does this pull request introduce a new feature? no ##### Was generative AI tooling used to co-author this PR? - [X] Yes Generated-by: Claude Code (claude-sonnet-5-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
