Skip to content

fix(deps): patch Dependabot CVEs — high/medium/low severity #209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vinodbhorge wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix(deps): patch Dependabot CVEs — high/medium/low severity #209

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4bac67e
fix(deps): patch high/medium CVEs across all modules
vinodbhorge Apr 24, 2026
3710dc7
fix(deps): override jackson-module-scala to 2.19.0 in dependencyManag…
vinodbhorge Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions analytics-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,15 +160,16 @@
<scope>test</scope>
</dependency>
<!-- -->
<!-- CVE-2026-34477/34478/34480/34479 (MED): log4j-core/api patched at 2.25.4 -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.25.3</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.25.3</version>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
Expand Down Expand Up @@ -274,10 +275,11 @@
</exclusion>
</exclusions>
</dependency>
<!-- CVE-2026-35554 (HIGH, CVSS 8.7): kafka-clients vulnerable >= 2.8.0, < 3.9.2 -->
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>kafka_${scala.maj.version}</artifactId>
<version>3.9.1</version>
<version>3.9.2</version>
<exclusions>
<exclusion>
<groupId>com.fasterxml.jackson.core</groupId>
Expand Down
3 changes: 3 additions & 0 deletions analytics-core/src/test/scala/org/ekstep/analytics/framework/util/TestDatasetUtil.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,9 @@ class TestDatasetUtil extends BaseSpec with Matchers with MockFactory {
case _: IOException => println("S3 Exception occurred")
case _: Exception => println("Exception occurred")
case illegalArgumentException: IllegalArgumentException => println("CSP Configurations are not found")
// Hadoop 3.4.x throws NoClassDefFoundError (an Error) for missing filesystem classes
// (e.g. NativeAzureFileSystem absent from classpath), whereas 3.3.x wrapped in RuntimeException
case _: Error => println("Storage filesystem class not found")
case _ =>
fail("Unexpected exception type thrown")
}
Expand Down
7 changes: 7 additions & 0 deletions analytics-job-driver/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,13 @@
<artifactId>lz4-java</artifactId>
<version>1.8.1</version>
</dependency>
<!-- CVE-2025-66566 (HIGH): at.yawk.lz4 groupId (distinct Maven coordinates from org.lz4).
Patched at >= 1.10.1; pinned at 1.10.4 to align with analytics-core and batch-models. -->
<dependency>
<groupId>at.yawk.lz4</groupId>
<artifactId>lz4-java</artifactId>
<version>1.10.4</version>
</dependency>
<dependency>
<groupId>org.scalatest</groupId>
<artifactId>scalatest_${scala.maj.version}</artifactId>
Expand Down
61 changes: 55 additions & 6 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,14 @@
<scala.version>2.13.14</scala.version>
<spark.maj.version>3.5</spark.maj.version>
<spark.version>3.5.8</spark.version>
<hadoop.version>3.3.4</hadoop.version>
<!-- CVE-2025-52999 (HIGH), CVE-2025-49128 (MED), GHSA-72hv-8253-57qq (MED):
Aligned with Spark 3.5.8 bundled Jackson 2.15.4 at runtime — the declared
version here governs compile-time resolution only; shaded JARs already exclude
com/fasterxml/jackson/**. Residual risk remains for the Spark-bundled version. -->
<jackson.version>2.15.4</jackson.version>
<!-- CVE-2024-23454 (LOW, CVSS 3.3): hadoop-common patched at 3.4.0; using 3.4.3 (latest).
All hadoop deps are provided scope — runtime cluster must supply >= 3.4.0 for actual fix. -->
<hadoop.version>3.4.3</hadoop.version>
<!-- jackson-core GHSA (MED): patched version 2.18.6 not yet on Maven Central; using 2.19.0
(latest stable, > 2.18.5 vulnerable range). Compile-time only — shaded JARs exclude
com/fasterxml/jackson/**. Spark 3.5.8 bundles Jackson 2.15.4 at runtime (still vulnerable;
requires Spark upgrade to fully remediate). -->
<jackson.version>2.19.0</jackson.version>
<paranamer.version>2.8</paranamer.version>
</properties>

Expand Down Expand Up @@ -173,6 +175,53 @@
<artifactId>bcprov-jdk15on</artifactId>
<version>1.70</version>
</dependency>
<!-- jackson-module-scala must match jackson.version to avoid ClassLoader conflict;
cloud-storage-sdk-aws brings 2.16.2 transitively — override to align with 2.19.0 -->
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-scala_${scala.maj.version}</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- CVE-2026-35554 (HIGH, CVSS 8.7): kafka-clients vulnerable >= 2.8.0, < 3.9.2 -->
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-clients</artifactId>
<version>3.9.2</version>
</dependency>
<!-- CVE-2023-1370 (HIGH, CVSS 7.5): json-smart vulnerable < 2.4.9 -->
<dependency>
<groupId>net.minidev</groupId>
<artifactId>json-smart</artifactId>
<version>2.4.9</version>
</dependency>
<!-- CVE-2026-34477/34478/34480 (MED), CVE-2026-34479 (MED): log4j-core/api/1.2-api vulnerable < 2.25.4 -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.25.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-1.2-api</artifactId>
<version>2.25.4</version>
</dependency>
<!-- CVE-2021-34429 (MED, CVSS 5.3): jetty-webapp vulnerable >= 9.4.37, < 9.4.43; pin 9.4.57 satisfies -->
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-webapp</artifactId>
<version>9.4.57.v20241219</version>
</dependency>
<!-- LOW: jetty-xml vulnerable <= 9.4.51; pin 9.4.57 satisfies patched >= 9.4.52 -->
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-xml</artifactId>
<version>9.4.57.v20241219</version>
</dependency>
</dependencies>
</dependencyManagement>

Expand Down
Loading