[fix][sec] Cherry-pick owasp-dependency-check fixes

buildtools/pom.xml

@@ -47,7 +47,7 @@
     <license-maven-plugin.version>4.1</license-maven-plugin.version>
     <puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
     <maven-checkstyle-plugin.version>3.1.2</maven-checkstyle-plugin.version>
-    <netty.version>4.1.94.Final</netty.version>
+    <netty.version>4.1.100.Final</netty.version>
     <guice.version>4.2.3</guice.version>
     <guava.version>32.1.1-jre</guava.version>
     <ant.version>1.10.12</ant.version>

distribution/server/src/assemble/LICENSE.bin.txt

@@ -265,7 +265,7 @@ The Apache Software License, Version 2.0
     - com.google.code.gson-gson-2.8.9.jar
     - io.gsonfire-gson-fire-1.8.5.jar
  * Guava
-    - com.google.guava-guava-32.1.1-jre.jar
+    - com.google.guava-guava-32.1.2-jre.jar
     - com.google.guava-failureaccess-1.0.1.jar
     - com.google.guava-listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- com.google.j2objc-j2objc-annotations-1.3.jar
@@ -289,27 +289,27 @@ The Apache Software License, Version 2.0
     - org.apache.commons-commons-lang3-3.11.jar
     - org.apache.commons-commons-text-1.10.0.jar
  * Netty
-    - io.netty-netty-buffer-4.1.94.Final.jar
-    - io.netty-netty-codec-4.1.94.Final.jar
-    - io.netty-netty-codec-dns-4.1.94.Final.jar
-    - io.netty-netty-codec-http-4.1.94.Final.jar
-    - io.netty-netty-codec-http2-4.1.94.Final.jar
-    - io.netty-netty-codec-socks-4.1.94.Final.jar
-    - io.netty-netty-codec-haproxy-4.1.94.Final.jar
-    - io.netty-netty-common-4.1.94.Final.jar
-    - io.netty-netty-handler-4.1.94.Final.jar
-    - io.netty-netty-handler-proxy-4.1.94.Final.jar
-    - io.netty-netty-resolver-4.1.94.Final.jar
-    - io.netty-netty-resolver-dns-4.1.94.Final.jar
-    - io.netty-netty-resolver-dns-classes-macos-4.1.94.Final.jar
-    - io.netty-netty-resolver-dns-native-macos-4.1.94.Final-osx-aarch_64.jar
-    - io.netty-netty-resolver-dns-native-macos-4.1.94.Final-osx-x86_64.jar
-    - io.netty-netty-transport-4.1.94.Final.jar
-    - io.netty-netty-transport-classes-epoll-4.1.94.Final.jar
-    - io.netty-netty-transport-native-epoll-4.1.94.Final-linux-x86_64.jar
-    - io.netty-netty-transport-native-epoll-4.1.94.Final.jar
-    - io.netty-netty-transport-native-unix-common-4.1.94.Final.jar
-    - io.netty-netty-transport-native-unix-common-4.1.94.Final-linux-x86_64.jar
+    - io.netty-netty-buffer-4.1.100.Final.jar
+    - io.netty-netty-codec-4.1.100.Final.jar
+    - io.netty-netty-codec-dns-4.1.100.Final.jar
+    - io.netty-netty-codec-http-4.1.100.Final.jar
+    - io.netty-netty-codec-http2-4.1.100.Final.jar
+    - io.netty-netty-codec-socks-4.1.100.Final.jar
+    - io.netty-netty-codec-haproxy-4.1.100.Final.jar
+    - io.netty-netty-common-4.1.100.Final.jar
+    - io.netty-netty-handler-4.1.100.Final.jar
+    - io.netty-netty-handler-proxy-4.1.100.Final.jar
+    - io.netty-netty-resolver-4.1.100.Final.jar
+    - io.netty-netty-resolver-dns-4.1.100.Final.jar
+    - io.netty-netty-resolver-dns-classes-macos-4.1.100.Final.jar
+    - io.netty-netty-resolver-dns-native-macos-4.1.100.Final-osx-aarch_64.jar
+    - io.netty-netty-resolver-dns-native-macos-4.1.100.Final-osx-x86_64.jar
+    - io.netty-netty-transport-4.1.100.Final.jar
+    - io.netty-netty-transport-classes-epoll-4.1.100.Final.jar
+    - io.netty-netty-transport-native-epoll-4.1.100.Final-linux-x86_64.jar
+    - io.netty-netty-transport-native-epoll-4.1.100.Final.jar
+    - io.netty-netty-transport-native-unix-common-4.1.100.Final.jar
+    - io.netty-netty-transport-native-unix-common-4.1.100.Final-linux-x86_64.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.61.Final.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar
@@ -383,25 +383,25 @@ The Apache Software License, Version 2.0
     - org.asynchttpclient-async-http-client-2.12.1.jar
     - org.asynchttpclient-async-http-client-netty-utils-2.12.1.jar
  * Jetty
-    - org.eclipse.jetty-jetty-client-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-continuation-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-http-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-io-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-proxy-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-security-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-server-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-servlet-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-servlets-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-util-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-util-ajax-9.4.51.v20230217.jar
-    - org.eclipse.jetty.websocket-javax-websocket-client-impl-9.4.51.v20230217.jar
-    - org.eclipse.jetty.websocket-websocket-api-9.4.51.v20230217.jar
-    - org.eclipse.jetty.websocket-websocket-client-9.4.51.v20230217.jar
-    - org.eclipse.jetty.websocket-websocket-common-9.4.51.v20230217.jar
-    - org.eclipse.jetty.websocket-websocket-server-9.4.51.v20230217.jar
-    - org.eclipse.jetty.websocket-websocket-servlet-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.51.v20230217.jar
-    - org.eclipse.jetty-jetty-alpn-server-9.4.51.v20230217.jar
+    - org.eclipse.jetty-jetty-client-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-continuation-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-http-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-io-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-proxy-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-security-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-server-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-servlet-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-servlets-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-util-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-util-ajax-9.4.53.v20231009.jar
+    - org.eclipse.jetty.websocket-javax-websocket-client-impl-9.4.53.v20231009.jar
+    - org.eclipse.jetty.websocket-websocket-api-9.4.53.v20231009.jar
+    - org.eclipse.jetty.websocket-websocket-client-9.4.53.v20231009.jar
+    - org.eclipse.jetty.websocket-websocket-common-9.4.53.v20231009.jar
+    - org.eclipse.jetty.websocket-websocket-server-9.4.53.v20231009.jar
+    - org.eclipse.jetty.websocket-websocket-servlet-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.53.v20231009.jar
+    - org.eclipse.jetty-jetty-alpn-server-9.4.53.v20231009.jar
  * SnakeYaml -- org.yaml-snakeyaml-2.0.jar
  * RocksDB - org.rocksdb-rocksdbjni-7.9.2.jar
  * Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.5.1.jar
@@ -480,11 +480,11 @@ The Apache Software License, Version 2.0
     - io.vertx-vertx-web-common-4.3.8.jar
     - io.vertx-vertx-grpc-4.3.5.jar
   * Apache ZooKeeper
-    - org.apache.zookeeper-zookeeper-3.8.1.jar
-    - org.apache.zookeeper-zookeeper-jute-3.8.1.jar
-    - org.apache.zookeeper-zookeeper-prometheus-metrics-3.8.1.jar
+    - org.apache.zookeeper-zookeeper-3.9.1.jar
+    - org.apache.zookeeper-zookeeper-jute-3.9.1.jar
+    - org.apache.zookeeper-zookeeper-prometheus-metrics-3.9.1.jar
   * Snappy Java
-    - org.xerial.snappy-snappy-java-1.1.10.1.jar
+    - org.xerial.snappy-snappy-java-1.1.10.5.jar
   * Google HTTP Client
     - com.google.http-client-google-http-client-gson-1.41.0.jar
     - com.google.http-client-google-http-client-1.41.0.jar
@@ -499,8 +499,6 @@ The Apache Software License, Version 2.0
     - com.github.seancfoley-ipaddress-5.3.3.jar
   * RxJava
     - io.reactivex.rxjava3-rxjava-3.0.1.jar
-  * RabbitMQ Java Client
-    - com.rabbitmq-amqp-client-5.5.3.jar
   * RoaringBitmap
     - org.roaringbitmap-RoaringBitmap-0.9.44.jar
 

distribution/shell/src/assemble/LICENSE.bin.txt

@@ -326,7 +326,7 @@ The Apache Software License, Version 2.0
  * Gson
     - gson-2.8.9.jar
  * Guava
-    - guava-32.1.1-jre.jar
+    - guava-32.1.2-jre.jar
     - failureaccess-1.0.1.jar
     - listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- j2objc-annotations-1.3.jar
@@ -344,22 +344,22 @@ The Apache Software License, Version 2.0
     - commons-text-1.10.0.jar
     - commons-compress-1.21.jar
  * Netty
-    - netty-buffer-4.1.94.Final.jar
-    - netty-codec-4.1.94.Final.jar
-    - netty-codec-dns-4.1.94.Final.jar
-    - netty-codec-http-4.1.94.Final.jar
-    - netty-codec-socks-4.1.94.Final.jar
-    - netty-codec-haproxy-4.1.94.Final.jar
-    - netty-common-4.1.94.Final.jar
-    - netty-handler-4.1.94.Final.jar
-    - netty-handler-proxy-4.1.94.Final.jar
-    - netty-resolver-4.1.94.Final.jar
-    - netty-resolver-dns-4.1.94.Final.jar
-    - netty-transport-4.1.94.Final.jar
-    - netty-transport-classes-epoll-4.1.94.Final.jar
-    - netty-transport-native-epoll-4.1.94.Final-linux-x86_64.jar
-    - netty-transport-native-unix-common-4.1.94.Final.jar
-    - netty-transport-native-unix-common-4.1.94.Final-linux-x86_64.jar
+    - netty-buffer-4.1.100.Final.jar
+    - netty-codec-4.1.100.Final.jar
+    - netty-codec-dns-4.1.100.Final.jar
+    - netty-codec-http-4.1.100.Final.jar
+    - netty-codec-socks-4.1.100.Final.jar
+    - netty-codec-haproxy-4.1.100.Final.jar
+    - netty-common-4.1.100.Final.jar
+    - netty-handler-4.1.100.Final.jar
+    - netty-handler-proxy-4.1.100.Final.jar
+    - netty-resolver-4.1.100.Final.jar
+    - netty-resolver-dns-4.1.100.Final.jar
+    - netty-transport-4.1.100.Final.jar
+    - netty-transport-classes-epoll-4.1.100.Final.jar
+    - netty-transport-native-epoll-4.1.100.Final-linux-x86_64.jar
+    - netty-transport-native-unix-common-4.1.100.Final.jar
+    - netty-transport-native-unix-common-4.1.100.Final-linux-x86_64.jar
     - netty-tcnative-boringssl-static-2.0.61.Final.jar
     - netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar
     - netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar
@@ -370,9 +370,9 @@ The Apache Software License, Version 2.0
     - netty-incubator-transport-classes-io_uring-0.0.21.Final.jar
     - netty-incubator-transport-native-io_uring-0.0.21.Final-linux-aarch_64.jar
     - netty-incubator-transport-native-io_uring-0.0.21.Final-linux-x86_64.jar
-    - netty-resolver-dns-classes-macos-4.1.94.Final.jar
-    - netty-resolver-dns-native-macos-4.1.94.Final-osx-aarch_64.jar
-    - netty-resolver-dns-native-macos-4.1.94.Final-osx-x86_64.jar
+    - netty-resolver-dns-classes-macos-4.1.100.Final.jar
+    - netty-resolver-dns-native-macos-4.1.100.Final-osx-aarch_64.jar
+    - netty-resolver-dns-native-macos-4.1.100.Final-osx-x86_64.jar
  * Prometheus client
     - simpleclient-0.16.0.jar
     - simpleclient_log4j2-0.16.0.jar
@@ -395,20 +395,20 @@ The Apache Software License, Version 2.0
     - async-http-client-2.12.1.jar
     - async-http-client-netty-utils-2.12.1.jar
  * Jetty
-    - jetty-client-9.4.51.v20230217.jar
-    - jetty-http-9.4.51.v20230217.jar
-    - jetty-io-9.4.51.v20230217.jar
-    - jetty-util-9.4.51.v20230217.jar
-    - javax-websocket-client-impl-9.4.51.v20230217.jar
-    - websocket-api-9.4.51.v20230217.jar
-    - websocket-client-9.4.51.v20230217.jar
-    - websocket-common-9.4.51.v20230217.jar
+    - jetty-client-9.4.53.v20231009.jar
+    - jetty-http-9.4.53.v20231009.jar
+    - jetty-io-9.4.53.v20231009.jar
+    - jetty-util-9.4.53.v20231009.jar
+    - javax-websocket-client-impl-9.4.53.v20231009.jar
+    - websocket-api-9.4.53.v20231009.jar
+    - websocket-client-9.4.53.v20231009.jar
+    - websocket-common-9.4.53.v20231009.jar
  * SnakeYaml -- snakeyaml-2.0.jar
  * Google Error Prone Annotations - error_prone_annotations-2.5.1.jar
  * Javassist -- javassist-3.25.0-GA.jar
   * Apache Avro
-    - avro-1.10.2.jar
-    - avro-protobuf-1.10.2.jar
+    - avro-1.11.3.jar
+    - avro-protobuf-1.11.3.jar
 
 BSD 3-clause "New" or "Revised" License
  * JSR305 -- jsr305-3.0.2.jar -- ../licenses/LICENSE-JSR305.txt

pom.xml

@@ -134,15 +134,15 @@ flexible messaging model and an intuitive client API.</description>
     <commons-compress.version>1.21</commons-compress.version>
 
     <bookkeeper.version>4.16.3</bookkeeper.version>
-    <zookeeper.version>3.8.1</zookeeper.version>
+    <zookeeper.version>3.9.1</zookeeper.version>
     <commons-cli.version>1.5.0</commons-cli.version>
     <commons-text.version>1.10.0</commons-text.version>
-    <snappy.version>1.1.10.1</snappy.version> <!-- ZooKeeper server -->
+    <snappy.version>1.1.10.5</snappy.version> <!-- ZooKeeper server -->
     <dropwizardmetrics.version>4.1.12.1</dropwizardmetrics.version> <!-- ZooKeeper server -->
     <curator.version>5.1.0</curator.version>
-    <netty.version>4.1.94.Final</netty.version>
+    <netty.version>4.1.100.Final</netty.version>
     <netty-iouring.version>0.0.21.Final</netty-iouring.version>
-    <jetty.version>9.4.51.v20230217</jetty.version>
+    <jetty.version>9.4.53.v20231009</jetty.version>
     <conscrypt.version>2.5.2</conscrypt.version>
     <jersey.version>2.34</jersey.version>
     <athenz.version>1.10.50</athenz.version>
@@ -159,7 +159,7 @@ flexible messaging model and an intuitive client API.</description>
     <reflections.version>0.10.2</reflections.version>
     <swagger.version>1.6.2</swagger.version>
     <puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
-    <docker-maven.version>0.42.1</docker-maven.version>
+    <docker-maven.version>0.43.3</docker-maven.version>
     <docker.verbose>true</docker.verbose>
     <typetools.version>0.5.0</typetools.version>
     <protobuf3.version>3.19.6</protobuf3.version>
@@ -175,9 +175,9 @@ flexible messaging model and an intuitive client API.</description>
     <cassandra.version>3.11.2</cassandra.version>
     <aerospike-client.version>4.4.20</aerospike-client.version>
     <kafka-client.version>3.4.0</kafka-client.version>
-    <rabbitmq-client.version>5.5.3</rabbitmq-client.version>
+    <rabbitmq-client.version>5.18.0</rabbitmq-client.version>
     <aws-sdk.version>1.12.262</aws-sdk.version>
-    <avro.version>1.10.2</avro.version>
+    <avro.version>1.11.3</avro.version>
     <joda.version>2.10.10</joda.version>
     <jclouds.version>2.5.0</jclouds.version>
     <guice.version>5.1.0</guice.version>
@@ -223,7 +223,7 @@ flexible messaging model and an intuitive client API.</description>
     <hppc.version>0.9.1</hppc.version>
     <spark-streaming_2.10.version>2.1.0</spark-streaming_2.10.version>
     <assertj-core.version>3.24.2</assertj-core.version>
-    <lombok.version>1.18.26</lombok.version>
+    <lombok.version>1.18.30</lombok.version>
     <javax.annotation-api.version>1.3.2</javax.annotation-api.version>
     <jaxb-api>2.3.1</jaxb-api>
     <javax.activation.version>1.2.0</javax.activation.version>

pulsar-broker/src/test/java/org/apache/pulsar/schema/compatibility/SchemaCompatibilityCheckTest.java

@@ -407,7 +407,7 @@ public void testSchemaComparison() throws Exception {
         assertEquals(admin.namespaces().getSchemaCompatibilityStrategy(namespaceName.toString()),
                 SchemaCompatibilityStrategy.UNDEFINED);
         byte[] changeSchemaBytes = (new String(Schema.AVRO(Schemas.PersonOne.class)
-                .getSchemaInfo().getSchema(), UTF_8) + "/n   /n   /n").getBytes();
+                .getSchemaInfo().getSchema(), UTF_8) + "\n   \n   \n").getBytes();
         SchemaInfo schemaInfo = SchemaInfo.builder().type(SchemaType.AVRO).schema(changeSchemaBytes).build();
         admin.schemas().createSchema(fqtn, schemaInfo);
 

pulsar-client/src/test/java/org/apache/pulsar/client/impl/schema/ProtobufSchemaTest.java

@@ -41,20 +41,20 @@ public class ProtobufSchemaTest {
             "\"namespace\":\"org.apache.pulsar.client.schema.proto.Test\"," +
             "\"fields\":[{\"name\":\"stringField\",\"type\":{\"type\":\"string\"," +
             "\"avro.java.string\":\"String\"},\"default\":\"\"},{\"name\":\"doubleField\"," +
-            "\"type\":\"double\",\"default\":0},{\"name\":\"intField\",\"type\":\"int\"," +
+            "\"type\":\"double\",\"default\":0.0},{\"name\":\"intField\",\"type\":\"int\"," +
             "\"default\":0},{\"name\":\"testEnum\",\"type\":{\"type\":\"enum\"," +
             "\"name\":\"TestEnum\",\"symbols\":[\"SHARED\",\"FAILOVER\"]}," +
             "\"default\":\"SHARED\"},{\"name\":\"nestedField\"," +
             "\"type\":[\"null\",{\"type\":\"record\",\"name\":\"SubMessage\"," +
             "\"fields\":[{\"name\":\"foo\",\"type\":{\"type\":\"string\"," +
             "\"avro.java.string\":\"String\"},\"default\":\"\"}" +
-            ",{\"name\":\"bar\",\"type\":\"double\",\"default\":0}]}]" +
+            ",{\"name\":\"bar\",\"type\":\"double\",\"default\":0.0}]}]" +
             ",\"default\":null},{\"name\":\"repeatedField\",\"type\":{\"type\":\"array\"" +
             ",\"items\":{\"type\":\"string\",\"avro.java.string\":\"String\"}},\"default\":[]}" +
             ",{\"name\":\"externalMessage\",\"type\":[\"null\",{\"type\":\"record\"" +
             ",\"name\":\"ExternalMessage\",\"namespace\":\"org.apache.pulsar.client.schema.proto.ExternalTest\"" +
             ",\"fields\":[{\"name\":\"stringField\",\"type\":{\"type\":\"string\",\"avro.java.string\":\"String\"}," +
-            "\"default\":\"\"},{\"name\":\"doubleField\",\"type\":\"double\",\"default\":0}]}],\"default\":null}]}";
+            "\"default\":\"\"},{\"name\":\"doubleField\",\"type\":\"double\",\"default\":0.0}]}],\"default\":null}]}";
 
     private static final String EXPECTED_PARSING_INFO = "{\"__alwaysAllowNull\":\"true\",\"__jsr310ConversionEnabled\":\"false\"," +
             "\"__PARSING_INFO__\":\"[{\\\"number\\\":1,\\\"name\\\":\\\"stringField\\\",\\\"type\\\":\\\"STRING\\\"," +

pulsar-io/kafka-connect-adaptor/pom.xml

@@ -116,6 +116,12 @@
       <groupId>io.confluent</groupId>
       <artifactId>kafka-connect-avro-converter</artifactId>
       <version>${confluent.version}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>