fix(deps): bump jackson, netty, pgjdbc and logback to patch CVEs - #798
Merged
Conversation
Resolves the HIGH findings reported by the Trivy scan on the pull request builds: - jackson 2.18.6 -> 2.21.4 - netty 4.2.13.Final -> 4.2.16.Final - postgresql 42.7.11 -> 42.7.12 - logback 1.5.32 -> 1.5.34 The cli and api-server modules import the Micronaut BOMs in their own dependencyManagement, which takes precedence over the inherited parent one. Jackson therefore resolved to Micronaut's 2.21.2 and pgjdbc to its 42.7.8, regardless of the parent pins. Both are now imported ahead of the Micronaut BOMs, mirroring what was already done for Netty. The pgjdbc version is centralized in the parent as postgresql.version so the Iceberg JDBC catalog driver no longer carries its own literal.
|
Contributor
Security Scan ResultsVulnerabilities detected: Scanned by Trivy |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the HIGH findings reported by the Trivy scan that runs on pull request builds (seen on #796).
Bumps
com.fasterxml.jacksonio.nettyorg.postgresqlch.qos.logbackTogether these clear every HIGH the scan reported across
pom.xml,cli,core,extension-rest-client,template-jinja,resource-generator,server/jikkou-api-serverand allproviders/*modules.Why more than a property bump was needed
cliandserver/jikkou-api-serverimport the Micronaut BOMs in their owndependencyManagement, which takes precedence over the inherited parent one. Bumpingjackson.versionin the parent alone had no effect there: those two modules kept resolving Micronaut's Jackson 2.21.2. That is why the scan reported two different Jackson versions.Chasing this surfaced a related issue the report understated: the same precedence rule meant
cliandapi-serverwere resolving pgjdbc to 42.7.8, i.e. older than the 42.7.11 declared in the Iceberg module.Both the Jackson BOM and pgjdbc are now imported ahead of the Micronaut BOMs, mirroring what was already in place for Netty. The pgjdbc version moves to a
postgresql.versionproperty in the parent so the Iceberg JDBC catalog driver no longer carries its own literal.Verification
dependency:treeacross all 18 modules: everyjackson/netty/postgresql/logbackartifact resolves to a patched version, no stragglers.Not addressed
org.lz4:lz4-java(CVE-2025-66566, CVE-2026-59949): Dependabot reports no patched version available upstream, so there is nothing to bump to.docs/package-lock.json(postcss, braces, decompress, picomatch): real open alerts, but they affect the docs site rather than the shipped artifacts. Better handled separately.