Security: remediate 22 open Dependabot alerts (Phase 0 dependency bumps) by rafaelbey · Pull Request #4924 · finos/legend-engine

rafaelbey · 2026-07-09T19:04:07Z

What

Eleven granular commits (one per dependency, independently revertable) clearing 2 critical + 12 high + 8 medium open Dependabot alerts:

Dependency	From → To	Alerts
aquasecurity/trivy-action	0.34.0 → 0.35.0 (SHA-pinned)	CVE-2026-33634 (critical, supply chain)
redshift-jdbc42	2.0.0.3 → 2.2.2	CVE-2026-8178 (critical RCE), CVE-2024-32888 (critical SQLi), CVE-2022-41828
postgresql	42.7.4 → 42.7.11	CVE-2026-42198, CVE-2025-49146
logback	1.2.3 → 1.2.13	CVE-2023-6378 (×2), CVE-2021-42550
jetty	9.4.44.v20210927 → 9.4.57.v20241219	CVE-2024-13009, CVE-2024-9823, CVE-2024-8184, CVE-2023-40167, CVE-2023-26048
json-smart	2.4.7 → 2.5.2	CVE-2023-1370
protobuf-java	3.25.3 → 3.25.5	CVE-2024-7254
commons-io	2.7 → 2.16.1	CVE-2024-47554
minio	8.5.5 → 8.6.0	CVE-2025-59952
classgraph	4.8.25 → 4.8.184	CVE-2021-47621
checkstyle (build-time)	8.25 → 8.29	CVE-2019-10782

Versions are aligned in lockstep with the parallel remediation efforts in legend-pure (security-remediation branch) and legend-shared (legend-shared-deps-update / 0.36.0-RC1).

Notable details

trivy-action: the 0.34.0 tag was deleted upstream after the supply-chain advisory, so the weekly Docker scan workflow has been failing to resolve the action for 5+ weeks — this also un-breaks it. Pinned by immutable commit SHA (tags can be re-pointed; that is the attack class behind the advisory), matching legend-shared's convention.
minio 8.6: moved to OkHttp 5.x, whose okhttp Maven artifact is an empty Kotlin-multiplatform shim. Added a managed okhttp-jvm dependency (real classes) with an org.jetbrains:* exclusion for dependency convergence, plus a dependency-analyzer ignore in the sole consumer (legend-engine-xt-iceberg-test-support).
jetty: also removes a hardcoded jetty-util:9.4.44 in legend-engine-xt-sql-postgres-server that shadowed the managed version. CVE-2026-2332 has no fix in the EOL 9.4 line (requires a Dropwizard/Jetty platform migration) and is deliberately out of scope.
checkstyle 8.29: 8.26+ flags blank lines within an import group (CustomImportOrder); added the same suppression legend-pure adopted, keeping the configs consistent.
redshift-jdbc42 is runtime-scope with no compiled-against usage, but note there is no Redshift PCT module or CI coverage — validated by full build/convergence only.

Verification

Full mvn clean install -DskipTests -T 4: BUILD SUCCESS (dependency convergence + compile + checkstyle across all modules)
Targeted test suites, all green: legend-engine-server-http-server (3,507 tests — Dropwizard boot on new Jetty/logback), legend-engine-xt-sql-postgres-server (116 tests — embedded Jetty + pg driver), legend-engine-shared-javaCompiler (11 tests — classgraph)
The Docker workflow does not trigger on this PR (Dockerfile path filter) — after merge, run it via workflow_dispatch or wait for the Tuesday cron to confirm the trivy fix.

🤖 Generated with Claude Code

…026-33634) The 0.34.0 tag was removed upstream after the trivy-action supply-chain advisory (GHSA-69fq-xp46-6x23), so the weekly Docker scan workflow has been failing to resolve the action since. 0.35.0 is the first patched release; all existing 'with:' inputs are unchanged. Pinned to the immutable commit SHA (with version comment) rather than a tag, since tags can be re-pointed if the action repo is compromised -- the attack class behind this advisory. Matches the pinning convention adopted in legend-shared.

…VE-2022-41828) Clears two critical alerts (RCE via unsafe class loading, SQL injection via line comment generation) and one high (remote command execution). Pure runtime-scope JDBC driver: no engine code compiles against com.amazon.redshift classes. Note Redshift has no PCT module or CI coverage; validated by full build + convergence only.

) Clears SCRAM authentication CPU-exhaustion DoS and channelBinding fallback issues. Runtime-scope driver; exercised by postgres PCT/SDT (testcontainers) in default CI.

Clears the logback serialization vulnerabilities. Stays on the 1.2.x line: logback 1.3+ requires SLF4J 2.x and breaks logback-contrib 0.1.5, both incompatible with the current enforcer SLF4J allowlist.

… medium CVEs) Clears the GzipHandler request-body smuggling issue plus CVE-2024-9823, CVE-2024-8184, CVE-2023-40167 and CVE-2023-26048. Same 9.4 line, API compatible. Also removes a hardcoded jetty-util 9.4.44 version in legend-engine-xt-sql-postgres-server that shadowed the managed version and failed dependency convergence. Note: CVE-2026-2332 has no fix in the EOL 9.4 line and requires a Dropwizard/Jetty platform migration, tracked separately.

Transitive pin only; no engine code imports net.minidev. 2.5.2 matches the version adopted in legend-shared-bom.

Patch bump clearing the nested-message stack-overflow DoS. Consumed transitively (grpc/cloud drivers); no direct engine usage.

Clears the XmlStreamReader DoS. Source and binary compatible; matches the version adopted in legend-pure.

Clears the XXE issue. Two consumers (EngineJavaCompiler and a changetoken test base); module tests pass. Matches the version adopted in legend-pure.

Clears the XML tag value substitution vulnerability. minio 8.6 moved to okhttp 5.x, whose 'okhttp' Maven artifact is an empty Kotlin multiplatform shim (Maven cannot follow Gradle module metadata to the real jar), breaking compilation of the sole minio consumer, legend-engine-xt-iceberg-test-support. Added a managed okhttp-jvm dependency carrying the actual classes, with the same org.jetbrains exclusion as minio for dependency convergence, and a dependency-analyzer ignore since the compile-time need (builder overload resolution) leaves no bytecode reference.

Build-time only dependency of maven-checkstyle-plugin. Checkstyle 8.26+ hardcodes a new CustomImportOrder violation for blank lines within an import group, which flagged 13 pre-existing sites; added the same SuppressionSingleFilter to checkstyle.xml as legend-pure to retain pre-8.26 behavior.

github-actions · 2026-07-09T21:00:26Z

Workflow Telemetry - Build CI / Build

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Build
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783623857000, 1783623860000
	Checkout repo : 1783623860000, 1783623866000
	Cache Maven dependencies : 1783623866000, 1783623876000
	Set up JDK : 1783623876000, 1783623887000
	Check Java version : 1783623887000, 1783623888000
	Configure git : 1783623888000, 1783623888000
	Download deps and plugins : 1783623888000, 1783623913000
	Restore legend-pure snapshot : done, 1783623913000, 1783623913000
	Set pure version override : 1783623913000, 1783623913000
	Collect Workflow Telemetry : 1783623913000, 1783623913000
	Set profiles that required github secrets : 1783623913000, 1783623913000
	Purge stale legend-engine artifacts from local Maven repo : 1783623913000, 1783623913000
	Build (PR) : 1783623913000, 1783630402000
	Build (Master + Docker Snapshot) : done, 1783630402000, 1783630402000
	Upload build output : 1783630402000, 1783630795000
	Upload m2 repository : 1783630795000, 1783630823000
	Purge engine artifacts before cache save : 1783630823000, 1783630823000
	Set Test Matrix : 1783630823000, 1783630823000
	Upload CI Event : 1783630823000, 1783630824000

github-actions · 2026-07-09T21:05:35Z

Workflow Telemetry - Build CI / Test Module - duckdb

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - duckdb
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783630995000
	Restore legend-pure snapshot : done, 1783630995000, 1783630995000
	Included Modules : 1783630995000, 1783630995000
	Test : 1783630995000, 1783631133000

github-actions · 2026-07-09T21:06:01Z

Workflow Telemetry - Build CI / Test Module - clickhouse

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - clickhouse
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630863000
	Checkout repo : 1783630863000, 1783630868000
	Before Test : 1783630868000, 1783631017000
	Restore legend-pure snapshot : done, 1783631017000, 1783631017000
	Included Modules : 1783631017000, 1783631017000
	Test : 1783631017000, 1783631158000
	Upload Test Results : 1783631158000, 1783631159000

github-actions · 2026-07-09T21:06:11Z

Workflow Telemetry - Build CI / Test Module - postgres

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - postgres
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783631014000
	Restore legend-pure snapshot : done, 1783631014000, 1783631014000
	Included Modules : 1783631014000, 1783631014000
	Test : 1783631014000, 1783631169000
	Upload Test Results : 1783631169000, 1783631170000

github-actions · 2026-07-09T21:06:26Z

Workflow Telemetry - Build CI / Test Module - graphql

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - graphql
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630863000, 1783630864000
	Checkout repo : 1783630864000, 1783630869000
	Before Test : 1783630869000, 1783631060000
	Restore legend-pure snapshot : done, 1783631060000, 1783631060000
	Included Modules : 1783631060000, 1783631060000
	Test : 1783631060000, 1783631182000
	Upload Test Results : 1783631182000, 1783631184000

github-actions · 2026-07-09T21:06:29Z

Workflow Telemetry - Build CI / Test Module - spanner

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - spanner
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631042000
	Restore legend-pure snapshot : done, 1783631042000, 1783631042000
	Included Modules : 1783631042000, 1783631042000
	Test : 1783631042000, 1783631185000
	Upload Test Results : 1783631185000, 1783631187000

github-actions · 2026-07-09T21:06:45Z

Workflow Telemetry - Build CI / Test Module - elasticsearch

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - elasticsearch
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630864000
	Checkout repo : 1783630864000, 1783630867000
	Before Test : 1783630867000, 1783631048000
	Restore legend-pure snapshot : done, 1783631048000, 1783631048000
	Included Modules : 1783631048000, 1783631048000
	Test : 1783631048000, 1783631202000
	Upload Test Results : 1783631202000, 1783631203000

github-actions · 2026-07-09T21:06:52Z

Workflow Telemetry - Build CI / Test Module - sqlserver

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - sqlserver
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783631055000
	Restore legend-pure snapshot : done, 1783631055000, 1783631055000
	Included Modules : 1783631055000, 1783631055000
	Test : 1783631055000, 1783631210000
	Upload Test Results : 1783631210000, 1783631210000

github-actions · 2026-07-09T21:07:05Z

Workflow Telemetry - Build CI / Test Module - h2

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - h2
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631050000
	Restore legend-pure snapshot : done, 1783631050000, 1783631050000
	Included Modules : 1783631050000, 1783631050000
	Test : 1783631050000, 1783631222000
	Upload Test Results : 1783631222000, 1783631223000

github-actions · 2026-07-09T21:07:48Z

Workflow Telemetry - Build CI / Test Module - relationalStore

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - relationalStore
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783631045000
	Restore legend-pure snapshot : done, 1783631045000, 1783631045000
	Included Modules : 1783631045000, 1783631045000
	Test : 1783631045000, 1783631266000
	Upload Test Results : 1783631266000, 1783631266000

github-actions · 2026-07-09T21:08:26Z

Workflow Telemetry - Build CI / Test Module - sql

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - sql
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630863000, 1783630865000
	Checkout repo : 1783630865000, 1783630868000
	Before Test : 1783630868000, 1783631074000
	Restore legend-pure snapshot : done, 1783631074000, 1783631074000
	Included Modules : 1783631074000, 1783631074000
	Test : 1783631074000, 1783631302000

github-actions · 2026-07-09T21:08:48Z

Workflow Telemetry - Build CI / Test Module - deephaven

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - deephaven
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630863000
	Checkout repo : 1783630863000, 1783630884000
	Before Test : 1783630884000, 1783631018000
	Restore legend-pure snapshot : done, 1783631018000, 1783631018000
	Included Modules : 1783631018000, 1783631018000
	Test : 1783631018000, 1783631325000
	Upload Test Results : 1783631325000, 1783631326000

github-actions · 2026-07-09T21:09:53Z

Workflow Telemetry - Build CI / Test Module - oracle

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - oracle
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631088000
	Restore legend-pure snapshot : done, 1783631088000, 1783631088000
	Included Modules : 1783631088000, 1783631088000
	Test : 1783631088000, 1783631390000
	Upload Test Results : 1783631390000, 1783631392000

github-actions · 2026-07-09T21:10:07Z

Workflow Telemetry - Build CI / Test Module - ide-tools

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - ide-tools
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630864000, 1783630865000
	Checkout repo : 1783630865000, 1783630868000
	Before Test : 1783630868000, 1783631016000
	Restore legend-pure snapshot : done, 1783631016000, 1783631017000
	Included Modules : 1783631017000, 1783631017000
	Test : 1783631017000, 1783631404000
	Upload Test Results : 1783631404000, 1783631405000

github-actions · 2026-07-09T21:10:24Z

Workflow Telemetry - Build CI / Test Module - memsql

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - memsql
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630863000
	Checkout repo : 1783630863000, 1783630868000
	Before Test : 1783630868000, 1783631009000
	Restore legend-pure snapshot : done, 1783631009000, 1783631009000
	Included Modules : 1783631009000, 1783631009000
	Test : 1783631009000, 1783631421000
	Upload Test Results : 1783631421000, 1783631422000

github-actions · 2026-07-09T21:10:37Z

Workflow Telemetry - Build CI / Test Module - trino

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - trino
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631091000
	Restore legend-pure snapshot : done, 1783631091000, 1783631091000
	Included Modules : 1783631091000, 1783631091000
	Test : 1783631091000, 1783631433000
	Upload Test Results : 1783631433000, 1783631435000

github-actions · 2026-07-09T21:11:57Z

Workflow Telemetry - Build CI / Test Module - core

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - core
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630862000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631074000
	Restore legend-pure snapshot : done, 1783631074000, 1783631074000
	Included Modules : 1783631074000, 1783631074000
	Test : 1783631074000, 1783631513000
	Upload Test Results : 1783631513000, 1783631515000

github-actions · 2026-07-09T21:12:45Z

Workflow Telemetry - Build CI / Test Module - javaBinding

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - javaBinding
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783631034000
	Restore legend-pure snapshot : done, 1783631034000, 1783631034000
	Included Modules : 1783631034000, 1783631034000
	Test : 1783631034000, 1783631563000
	Upload Test Results : 1783631563000, 1783631563000

github-actions · 2026-07-09T21:22:00Z

Workflow Telemetry - Build CI / Test Module - snowflake

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - snowflake
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783631002000
	Restore legend-pure snapshot : done, 1783631002000, 1783631002000
	Included Modules : 1783631002000, 1783631002000
	Test : 1783631002000, 1783632118000
	Upload Test Results : 1783632118000, 1783632118000

github-actions · 2026-07-09T21:27:13Z

Workflow Telemetry - Build CI / Run Unit Tests

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Run Unit Tests
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783630997000
	Restore legend-pure snapshot : done, 1783630997000, 1783630997000
	Excluded Modules : 1783630997000, 1783630997000
	Test : 1783630997000, 1783632431000
	Upload Test Results : 1783632431000, 1783632432000

github-actions · 2026-07-09T21:27:45Z

Workflow Telemetry - Build CI / Test Module - server

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - server
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631071000
	Restore legend-pure snapshot : done, 1783631071000, 1783631071000
	Included Modules : 1783631071000, 1783631071000
	Test : 1783631071000, 1783632461000
	Upload Test Results : 1783632461000, 1783632463000

github-actions · 2026-07-09T21:27:54Z

Workflow Telemetry - Build CI / Test Module - python

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - python
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630862000
	Checkout repo : 1783630862000, 1783630867000
	Before Test : 1783630867000, 1783631017000
	Restore legend-pure snapshot : done, 1783631017000, 1783631017000
	Included Modules : 1783631017000, 1783631017000
	Test : 1783631017000, 1783632472000
	Upload Test Results : 1783632472000, 1783632473000

github-actions · 2026-07-09T21:30:25Z

Workflow Telemetry - Build CI / Test Module - databricks

Workflow telemetry for commit e6c95e93b530a5152258dc5ebb4316256e5593ef
You can access workflow job details here

Step Trace

gantt
	title Test Module - databricks
	dateFormat x
	axisFormat %H:%M:%S
	Set up job : milestone, 1783630861000, 1783630863000
	Checkout repo : 1783630863000, 1783630867000
	Before Test : 1783630867000, 1783631058000
	Restore legend-pure snapshot : done, 1783631058000, 1783631058000
	Included Modules : 1783631058000, 1783631058000
	Test : 1783631058000, 1783632622000
	Upload Test Results : 1783632622000, 1783632623000

github-actions · 2026-07-09T21:33:05Z

Test Results

  1 128 files ±0   1 128 suites ±0 4h 20m 55s ⏱️ - 3m 55s
14 685 tests ±0 14 506 ✔️ ±0 179 💤 ±0 0 ❌ ±0
40 787 runs ±0 40 608 ✔️ ±0 179 💤 ±0 0 ❌ ±0

Results for commit e6c95e9. ± Comparison against base commit bd13a75.

♻️ This comment has been updated with latest results.

Follow-up to the 42.7.11 bump: CVE-2026-54291 (medium) was published against <= 42.7.11 and flagged by the Mend scan on the PR; 42.7.12 is the first fixed release.

…VE-2026-0636) minio 8.6.0 pulls bcprov-jdk18on 1.81 transitively, which carries two critical and one medium CVE fixed in 1.84. Managed pin raises the resolved version; the engine's own direct BouncyCastle dependency is the separate legacy bcprov-jdk15on artifact and will be migrated to the -jdk18on line in its own change.

@after

TestQueryStoreManager and TestDataCubeQueryStoreManager built their store from a field-initializer TestMongoClientProvider, then @before replaced the provider field with a fresh instance the store never used, and @after cleaned only that unused instance. JUnit instantiates the test class per test method, so every test leaked the embedded Mongo server it was actually using -- 81 leaked servers per run, exhausting file descriptors on high-core machines (netty event-loop pools scale with core count) and failing with 'Too many open files'. Construct the store in @before wired to the same provider that @after shuts down: one server per test, always cleaned. Suite runs ~10x faster (13s vs 133s).

rafaelbey · 2026-07-10T01:29:13Z

Note on remaining Mend/WhiteSource findings

The Mend scan reports this branch remediates 45 vulnerabilities. The findings it lists as "introduced" fall into four groups — two were real and are fixed by follow-up commits on this branch; two are pre-existing issues that Mend re-counts because the artifact version changed, and are documented deferrals:

Fixed on this branch:

bcprov-jdk18on:1.81 (transitive via minio 8.6.0, 2 critical + 1 medium) → managed pin to 1.84 (cd9e5d5)
postgresql CVE-2026-54291 (published after the initial bump) → 42.7.12 (9ee04da)

Deferred, with rationale:

logback-core 1.2.13 (CVE-2024-12798, CVE-2025-11226, et al.): no fix exists in the 1.2.x line. logback 1.3+ requires SLF4J 2.x and breaks logback-contrib 0.1.5 (used for the server's JSON log layout), both currently pinned by the Dropwizard 1.3 platform. These CVEs also require an attacker who can already modify the logback configuration file. Tracked for the Dropwizard/SLF4J-2 platform migration; 1.2.13 clears everything fixable on the current line (CVE-2023-6378, CVE-2021-42550).
jetty-http 9.4.57 (CVE-2026-2332, CVE-2024-6763): no fix exists in the EOL 9.4 line — Mend's suggested "9.4.60" does not exist on Maven Central. Fixing requires Jetty 10+, which requires leaving Dropwizard 1.3 (Bundle API removal, dropwizard-swagger, jakarta namespace) — a platform migration tracked as its own initiative. 9.4.57 clears everything fixable on 9.4 (CVE-2024-13009 + 4 medium CVEs).

These two deferrals match the positions taken in the parallel remediation efforts in legend-pure (security-remediation) and legend-shared (0.36.0-RC1), which also remain on Dropwizard 1.3 / Jetty 9.4 / logback 1.2.

rafaelbey added 11 commits July 9, 2026 14:30

Bump postgresql driver 42.7.4 -> 42.7.11 (CVE-2026-42198, CVE-2025-49146

22c3564

) Clears SCRAM authentication CPU-exhaustion DoS and channelBinding fallback issues. Runtime-scope driver; exercised by postgres PCT/SDT (testcontainers) in default CI.

Bump logback 1.2.3 -> 1.2.13 (CVE-2023-6378, CVE-2021-42550)

8a0e9fc

Clears the logback serialization vulnerabilities. Stays on the 1.2.x line: logback 1.3+ requires SLF4J 2.x and breaks logback-contrib 0.1.5, both incompatible with the current enforcer SLF4J allowlist.

Bump json-smart 2.4.7 -> 2.5.2 (CVE-2023-1370)

81ccdb0

Transitive pin only; no engine code imports net.minidev. 2.5.2 matches the version adopted in legend-shared-bom.

Bump protobuf-java 3.25.3 -> 3.25.5 (CVE-2024-7254)

556fc60

Patch bump clearing the nested-message stack-overflow DoS. Consumed transitively (grpc/cloud drivers); no direct engine usage.

Bump commons-io 2.7 -> 2.16.1 (CVE-2024-47554)

c4a1aaf

Clears the XmlStreamReader DoS. Source and binary compatible; matches the version adopted in legend-pure.

Bump classgraph 4.8.25 -> 4.8.184 (CVE-2021-47621)

0ec6f80

Clears the XXE issue. Two consumers (EngineJavaCompiler and a changetoken test base); module tests pass. Matches the version adopted in legend-pure.

rafaelbey requested a review from a team as a code owner July 9, 2026 19:04

rafaelbey added 3 commits July 9, 2026 21:26

Bump postgresql driver 42.7.11 -> 42.7.12 (CVE-2026-54291)

9ee04da

Follow-up to the 42.7.11 bump: CVE-2026-54291 (medium) was published against <= 42.7.11 and flagged by the Mend scan on the PR; 42.7.12 is the first fixed release.

Uh oh!

Conversation

rafaelbey commented Jul 9, 2026

What

Notable details

Verification

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Build

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - duckdb

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - clickhouse

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - postgres

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - graphql

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - spanner

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - elasticsearch

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - sqlserver

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - h2

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - relationalStore

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - sql

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - deephaven

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - oracle

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - ide-tools

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - memsql

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - trino

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - core

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

Workflow Telemetry - Build CI / Test Module - javaBinding

Step Trace

Uh oh!

github-actions Bot commented Jul 9, 2026

github-actions Bot commented Jul 9, 2026 •

edited

Loading