From 6257030e2958d553cf2fbb621537ce0d614b4998 Mon Sep 17 00:00:00 2001 From: Aviral Jain Date: Tue, 1 Sep 2026 20:13:02 +0530 Subject: [PATCH] =?UTF-8?q?fix:=20resolve=20all=20snyk=20vulnerabilities?= =?UTF-8?q?=20(52=20=E2=86=92=200)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump dependency versions flagged by snyk container scan: - jackson 2.19.4 → 2.18.10 (2 critical deserialization/unsafe-reflection, SSRF, resource exhaustion; 2.18 line kept for kafka-connect-client compat - PropertyNamingStrategy.SNAKE_CASE removed in 2.21) - netty 4.2.13 → 4.2.17.Final, all modules forced (2 critical, 9 high) - jetty unified to 12.0.36 incl. jetty-security (was mixed 12.0.33/12.1.2) - logback 1.5.25 → 1.5.36 - vertx-core 4.5.27 → 4.5.30 - httpclient5 5.5 → 5.6.4, httpcore5(-h2) 5.3.5 → 5.4.3 - at.yawk.lz4:lz4-java 1.10.1 → 1.11.1 - plexus-utils 3.5.1 → 3.6.1 log4j-api 2.25.4 has no fix available (already latest); added .snyk ignore with justification (bridged to slf4j/logback at runtime). Verified: snyk container test 231 deps, 0 vulnerable paths; full test suite 284 tests, 0 failures. --- .snyk | 9 ++++++++ build.gradle | 54 +++++++++++++++++++++++++++++++---------------- gradle.properties | 3 ++- 3 files changed, 47 insertions(+), 19 deletions(-) diff --git a/.snyk b/.snyk index b110c2cbf..7e34e42ea 100644 --- a/.snyk +++ b/.snyk @@ -1,6 +1,15 @@ # Snyk (https://snyk.io) policy file version: v1.25.0 ignore: + SNYK-JAVA-ORGAPACHELOGGINGLOG4J-17954276: + - '*': + reason: >- + log4j-api 2.25.4 is already the latest published version; Snyk + reports no upgrade or patch available for this CVE. log4j-core is + forced to the same version and log4j is bridged to slf4j/logback in + our runtime (log4j-slf4j impls excluded), so the affected output + encoding path is not used. + expires: 2026-12-31T00:00:00.000Z SNYK-JAVA-COMSQUAREUPWIRE-16771313: - '*': reason: >- diff --git a/build.gradle b/build.gradle index 76edcb8a2..dd9fb0942 100644 --- a/build.gradle +++ b/build.gradle @@ -55,35 +55,53 @@ configurations.all { force("org.apache.kafka:kafka-raft:" + kafkaVersion) force("com.fasterxml.jackson.core:jackson-core:" + jacksonVersion) force("com.fasterxml.jackson.core:jackson-databind:" + jacksonVersion) - force("com.fasterxml.jackson.core:jackson-annotations:" + jacksonVersion) + force("com.fasterxml.jackson.core:jackson-annotations:" + jacksonAnnotationsVersion) force("com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:" + jacksonVersion) force("com.fasterxml.jackson.module:jackson-module-scala_" + kafkaScalaVersion + ":" + jacksonVersion) - force("io.netty:netty-codec-http:4.2.13.Final") - force("io.netty:netty-codec-http2:4.2.13.Final") - force("io.netty:netty-handler-proxy:4.2.13.Final") - force("io.netty:netty-transport-classes-epoll:4.2.13.Final") - force("io.netty:netty-codec-dns:4.2.13.Final") - force("io.netty:netty-all:4.2.13.Final") + force("io.netty:netty-common:4.2.17.Final") + force("io.netty:netty-buffer:4.2.17.Final") + force("io.netty:netty-transport:4.2.17.Final") + force("io.netty:netty-resolver:4.2.17.Final") + force("io.netty:netty-codec:4.2.17.Final") + force("io.netty:netty-codec-base:4.2.17.Final") + force("io.netty:netty-codec-compression:4.2.17.Final") + force("io.netty:netty-codec-http:4.2.17.Final") + force("io.netty:netty-codec-http2:4.2.17.Final") + force("io.netty:netty-codec-socks:4.2.17.Final") + force("io.netty:netty-codec-marshalling:4.2.17.Final") + force("io.netty:netty-codec-protobuf:4.2.17.Final") + force("io.netty:netty-handler:4.2.17.Final") + force("io.netty:netty-handler-proxy:4.2.17.Final") + force("io.netty:netty-resolver-dns:4.2.17.Final") + force("io.netty:netty-transport-classes-epoll:4.2.17.Final") + force("io.netty:netty-transport-native-unix-common:4.2.17.Final") + force("io.netty:netty-codec-dns:4.2.17.Final") + force("io.netty:netty-all:4.2.17.Final") force("io.grpc:grpc-netty-shaded:1.75.0") force("org.apache.commons:commons-lang3:3.18.0") - force("io.vertx:vertx-core:4.5.27") - force("ch.qos.logback:logback-core:1.5.25") - force("ch.qos.logback:logback-classic:1.5.25") + force("io.vertx:vertx-core:4.5.30") + force("ch.qos.logback:logback-core:1.5.36") + force("ch.qos.logback:logback-classic:1.5.36") force("com.nimbusds:nimbus-jose-jwt:9.37.4") force("commons-beanutils:commons-beanutils:1.11.0") force("org.apache.logging.log4j:log4j-api:2.25.4") force("org.apache.logging.log4j:log4j-core:2.25.4") - force("org.apache.httpcomponents.core5:httpcore5-h2:5.3.5") + force("org.apache.httpcomponents.client5:httpclient5:5.6.4") + force("org.apache.httpcomponents.core5:httpcore5:5.4.3") + force("org.apache.httpcomponents.core5:httpcore5-h2:5.4.3") + force("at.yawk.lz4:lz4-java:1.11.1") + force("org.codehaus.plexus:plexus-utils:3.6.1") force("org.bouncycastle:bcpkix-jdk18on:1.84") force("org.bouncycastle:bcprov-jdk18on:1.84") force("org.bouncycastle:bc-fips:2.1.2") force("org.apache.zookeeper:zookeeper:3.9.5") - force("org.eclipse.jetty:jetty-http:12.0.33") - force("org.eclipse.jetty:jetty-server:12.0.33") - force("org.eclipse.jetty:jetty-client:12.0.33") - force("org.eclipse.jetty:jetty-io:12.0.33") - force("org.eclipse.jetty:jetty-util:12.0.33") + force("org.eclipse.jetty:jetty-http:12.0.36") + force("org.eclipse.jetty:jetty-server:12.0.36") + force("org.eclipse.jetty:jetty-client:12.0.36") + force("org.eclipse.jetty:jetty-io:12.0.36") + force("org.eclipse.jetty:jetty-util:12.0.36") + force("org.eclipse.jetty:jetty-security:12.0.36") } } @@ -234,8 +252,8 @@ test { } dependencies { - testImplementation 'ch.qos.logback:logback-classic:1.5.25' - testImplementation 'ch.qos.logback:logback-core:1.5.25' + testImplementation 'ch.qos.logback:logback-classic:1.5.36' + testImplementation 'ch.qos.logback:logback-core:1.5.36' // Log4j dependencies needed by KsqlDB at test runtime // KsqlDB requires actual Log4j implementation, not bridges diff --git a/gradle.properties b/gradle.properties index e17def0d3..26218ce4c 100644 --- a/gradle.properties +++ b/gradle.properties @@ -3,4 +3,5 @@ confluentVersion=8.1.0 kafkaVersion=4.0.2 kafkaScalaVersion=2.13 lombokVersion=1.18.42 -jacksonVersion=2.19.4 \ No newline at end of file +jacksonVersion=2.18.10 +jacksonAnnotationsVersion=2.18.10