Skip to content

Commit c8f66fa

Browse files
dlvenabledlvenable
authored
Updates several dependencies to address CVEs (#5914)
Updates several dependencies to address CVEs * CVE-2025-46762 - Parquet 1.15.2 * CVE-2025-48734 - commons-beanutils 1.11.0 and Checkstyle 10.26.1 * CVE-2024-57699 - json-smart 2.5.2 * CVE-2025-24970 - Netty 4.1.123 * CVE-2025-27817 - Apache Kafka 3.9.1 and Confluent Kafka 7.9.1 Also, removes some broken code related to the kafka-client in unused Kafka tests. Signed-off-by: David Venable <dlv@amazon.com>
1 parent 74db304 commit c8f66fa

5 files changed

Lines changed: 22 additions & 35 deletions

File tree

‎build.gradle‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ allprojects {
4747
}
4848

4949
checkstyle {
50-
toolVersion = '10.12.3'
50+
toolVersion = '10.26.1'
5151
}
5252
}
5353

@@ -147,9 +147,9 @@ subprojects {
147147
}
148148
implementation('net.minidev:json-smart') {
149149
version {
150-
require '2.5.0'
150+
require '2.5.2'
151151
}
152-
because 'CVE from transitive dependencies'
152+
because 'CVE from transitive dependencies, including CVE-2024-57699'
153153
}
154154
implementation('org.jetbrains.kotlin:kotlin-stdlib') {
155155
version {
@@ -217,18 +217,24 @@ subprojects {
217217
}
218218
because 'CVE-2024-25710, CVE-2024-26308'
219219
}
220+
implementation('commons-beanutils:commons-beanutils') {
221+
version {
222+
require '1.11.0'
223+
}
224+
because 'CVE-2025-48734'
225+
}
220226
}
221227
}
222228

223229
configurations.all {
224230
resolutionStrategy.eachDependency { def details ->
225231
if (details.requested.group == 'io.netty') {
226232
if (details.requested.name == 'netty') {
227-
details.useTarget group: 'io.netty', name: 'netty-all', version: '4.1.108.Final'
228-
details.because 'Fixes CVE-2022-41881, CVE-2021-21290 and CVE-2022-41915.'
233+
details.useTarget group: 'io.netty', name: 'netty-all', version: '4.1.123.Final'
234+
details.because 'Fixes CVE-2025-24970, CVE-2022-41881, CVE-2021-21290 and CVE-2022-41915.'
229235
} else if (!details.requested.name.startsWith('netty-tcnative')) {
230-
details.useVersion '4.1.108.Final'
231-
details.because 'Fixes CVE-2022-41881, CVE-2021-21290 and CVE-2022-41915.'
236+
details.useVersion '4.1.123.Final'
237+
details.because 'Fixes CVE-2025-24970, CVE-2022-41881, CVE-2021-21290 and CVE-2022-41915.'
232238
}
233239
} else if (details.requested.group == 'log4j' && details.requested.name == 'log4j') {
234240
details.useTarget group: 'org.apache.logging.log4j', name: 'log4j-1.2-api', version: '2.17.1'

‎data-prepper-plugins/kafka-plugins/build.gradle‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,16 @@ dependencies {
3232
implementation project(':data-prepper-plugins:encryption-plugin')
3333
// bump io.confluent:* dependencies correspondingly when bumping org.apache.kafka.*
3434
// https://docs.confluent.io/platform/current/release-notes/index.html
35-
implementation 'org.apache.kafka:kafka-clients:3.6.1'
36-
implementation 'org.apache.kafka:connect-json:3.6.1'
35+
implementation 'org.apache.kafka:kafka-clients:3.9.1'
36+
implementation 'org.apache.kafka:connect-json:3.9.1'
3737
implementation project(':data-prepper-plugins:http-common')
3838
implementation libs.avro.core
3939
implementation 'com.fasterxml.jackson.core:jackson-databind'
4040
implementation 'io.micrometer:micrometer-core'
4141
implementation libs.commons.lang3
42-
implementation 'io.confluent:kafka-avro-serializer:7.6.0'
43-
implementation 'io.confluent:kafka-json-schema-serializer:7.6.0'
44-
implementation 'io.confluent:kafka-schema-registry-client:7.6.0'
42+
implementation 'io.confluent:kafka-avro-serializer:7.9.1'
43+
implementation 'io.confluent:kafka-json-schema-serializer:7.9.1'
44+
implementation 'io.confluent:kafka-schema-registry-client:7.9.1'
4545
implementation 'software.amazon.awssdk:sts'
4646
implementation 'software.amazon.awssdk:auth'
4747
implementation 'software.amazon.awssdk:kafka'
@@ -77,8 +77,8 @@ dependencies {
7777
testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml'
7878

7979
integrationTestImplementation testLibs.junit.vintage
80-
integrationTestImplementation 'io.confluent:kafka-schema-registry:7.6.0'
81-
integrationTestImplementation ('io.confluent:kafka-schema-registry:7.6.0:tests') {
80+
integrationTestImplementation 'io.confluent:kafka-schema-registry:7.9.1'
81+
integrationTestImplementation ('io.confluent:kafka-schema-registry:7.9.1:tests') {
8282
exclude group: 'org.glassfish.jersey.containers', module: 'jersey-container-servlet'
8383
exclude group: 'org.glassfish.jersey.inject', module: 'jersey-hk2'
8484
exclude group: 'org.glassfish.jersey.ext', module: 'jersey-bean-validation'

‎data-prepper-plugins/kafka-plugins/src/integrationTest/java/org/opensearch/dataprepper/plugins/kafka/source/EmbeddedKafkaClusterSingleNode.java‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
import io.confluent.kafka.schemaregistry.RestApp;
99
import io.confluent.kafka.schemaregistry.avro.AvroCompatibilityLevel;
1010
import io.confluent.kafka.schemaregistry.rest.SchemaRegistryConfig;
11-
import kafka.server.KafkaConfig$;
1211
import org.junit.rules.ExternalResource;
1312
import org.slf4j.Logger;
1413
import org.slf4j.LoggerFactory;
@@ -58,8 +57,6 @@ public void start() throws Exception {
5857
log.debug("ZooKeeper instance is running at {}", zookeeper.connectString());
5958

6059
final Properties effectiveBrokerConfig = effectiveBrokerConfigFrom(brokerConfig, zookeeper);
61-
log.debug("Starting a Kafka instance on ...",
62-
effectiveBrokerConfig.getProperty(KafkaConfig$.MODULE$.ZkConnectDoc()));
6360
broker = new EmbeddedKafkaServer(effectiveBrokerConfig);
6461
log.debug("Kafka instance is running at {}, connected to ZooKeeper at {}",
6562
broker.brokerList(), broker.zookeeperConnect());
@@ -80,15 +77,6 @@ public void start() throws Exception {
8077
private Properties effectiveBrokerConfigFrom(final Properties brokerConfig, final EmbeddedZooKeeperServer zookeeper) {
8178
final Properties effectiveConfig = new Properties();
8279
effectiveConfig.putAll(brokerConfig);
83-
effectiveConfig.put(KafkaConfig$.MODULE$.ZkConnectProp(), zookeeper.connectString());
84-
effectiveConfig.put(KafkaConfig$.MODULE$.ZkSessionTimeoutMsProp(), 30 * 1000);
85-
effectiveConfig.put(KafkaConfig$.MODULE$.ZkConnectionTimeoutMsProp(), 60 * 1000);
86-
effectiveConfig.put(KafkaConfig$.MODULE$.DeleteTopicEnableProp(), true);
87-
effectiveConfig.put(KafkaConfig$.MODULE$.LogCleanerDedupeBufferSizeProp(), 2 * 1024 * 1024L);
88-
effectiveConfig.put(KafkaConfig$.MODULE$.GroupMinSessionTimeoutMsProp(), 0);
89-
effectiveConfig.put(KafkaConfig$.MODULE$.OffsetsTopicReplicationFactorProp(), (short) 1);
90-
effectiveConfig.put(KafkaConfig$.MODULE$.OffsetsTopicPartitionsProp(), 1);
91-
effectiveConfig.put(KafkaConfig$.MODULE$.AutoCreateTopicsEnableProp(), true);
9280
return effectiveConfig;
9381
}
9482

‎data-prepper-plugins/kafka-plugins/src/integrationTest/java/org/opensearch/dataprepper/plugins/kafka/source/EmbeddedKafkaServer.java‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77

88

99
import kafka.server.KafkaConfig;
10-
import kafka.server.KafkaConfig$;
1110
import kafka.server.KafkaServer;
1211
import kafka.utils.TestUtils;
1312
import org.apache.kafka.clients.admin.AdminClient;
@@ -61,19 +60,13 @@ public EmbeddedKafkaServer(final Properties config) throws IOException {
6160

6261
private Properties effectiveConfigFrom(final Properties initialConfig) throws IOException {
6362
final Properties effectiveConfig = new Properties();
64-
effectiveConfig.put(KafkaConfig$.MODULE$.BrokerIdProp(), 1);
65-
effectiveConfig.put(KafkaConfig$.MODULE$.NumPartitionsProp(), 1);
66-
effectiveConfig.put(KafkaConfig$.MODULE$.AutoCreateTopicsEnableProp(), true);
67-
effectiveConfig.put(KafkaConfig$.MODULE$.MessageMaxBytesProp(), 1000000);
68-
effectiveConfig.put(KafkaConfig$.MODULE$.ControlledShutdownEnableProp(), true);
6963

7064
effectiveConfig.putAll(initialConfig);
71-
effectiveConfig.setProperty(KafkaConfig$.MODULE$.LogDirProp(), logDir.getAbsolutePath());
7265
return effectiveConfig;
7366
}
7467

7568
public String brokerList() {
76-
return kafka.config().zkConnect();
69+
return "";
7770
}
7871

7972

‎settings.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ dependencyResolutionManagement {
6161
library('commons-io', 'commons-io', 'commons-io').version('2.15.1')
6262
library('commons-codec', 'commons-codec', 'commons-codec').version('1.16.0')
6363
library('commons-compress', 'org.apache.commons', 'commons-compress').version('1.24.0')
64-
version('parquet', '1.15.1')
64+
version('parquet', '1.15.2')
6565
library('parquet-common', 'org.apache.parquet', 'parquet-common').versionRef('parquet')
6666
library('parquet-avro', 'org.apache.parquet', 'parquet-avro').versionRef('parquet')
6767
library('parquet-column', 'org.apache.parquet', 'parquet-column').versionRef('parquet')

0 commit comments

Comments
 (0)