Security: remediate 22 open Dependabot alerts (Phase 0 dependency bumps)

.github/workflows/docker.yml

@@ -46,7 +46,7 @@ jobs:
         # NOTE: if this gets more complicated, consider having this as a bash script
         run: mkdir -p ./${{ matrix.module.parent }}/${{ matrix.module.name }}/target && touch ./${{ matrix.module.parent }}/${{ matrix.module.name }}/target/${{ matrix.module.name }}-dummy.jar && docker build --quiet --tag local/${{ matrix.module.name }}:${{ github.sha }} ./${{ matrix.module.parent }}/${{ matrix.module.name }}
       - name: Scan image for security issues
-        uses: aquasecurity/trivy-action@0.34.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
         with:
           # TODO: we should probably also setup misconfiguration scanning
           # See https://github.com/aquasecurity/trivy-action#using-trivy-to-scan-infrastucture-as-code

checkstyle.xml

@@ -36,6 +36,16 @@
     <module name="FileTabCharacter">
         <property name="eachLine" value="true"/>
     </module>
+
+    <!-- Checkstyle 8.26+ hardcodes a new CustomImportOrder violation for blank lines
+         within an import group. With no customImportOrderRules configured (as here),
+         all imports form a single group, so this flags every blank line inside any
+         import block. Suppress to retain pre-8.26 behavior. -->
+    <module name="SuppressionSingleFilter">
+        <property name="checks" value="CustomImportOrder"/>
+        <property name="message" value="Extra separation in import group"/>
+    </module>
+
     <module name="TreeWalker">
         <module name="OuterTypeFilename"/>
         <module name="IllegalTokenText">

legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestDataCubeQueryStoreManager.java

@@ -127,8 +127,8 @@ DataCubeQuery build()
         }
     }
 
-    private TestMongoClientProvider testMongoClientProvider = new TestMongoClientProvider();
-    private final DataCubeQueryStoreManager store = new DataCubeQueryStoreManager(testMongoClientProvider.mongoClient);
+    private TestMongoClientProvider testMongoClientProvider;
+    private DataCubeQueryStoreManager store;
     private static final TestVaultImplementation testVaultImplementation = new TestVaultImplementation();
 
     @BeforeClass
@@ -150,6 +150,7 @@ public static void cleanUpClass()
     public void setup()
     {
         this.testMongoClientProvider = new TestMongoClientProvider();
+        this.store = new DataCubeQueryStoreManager(this.testMongoClientProvider.mongoClient);
     }
 
     @After

legend-engine-application-query/src/test/java/org/finos/legend/engine/application/query/api/TestQueryStoreManager.java

@@ -318,8 +318,8 @@ private static QueryParameterValue createTestParameterValue(String name, String
         return queryParameterValue;
     }
 
-    private TestMongoClientProvider testMongoClientProvider = new TestMongoClientProvider();
-    private final QueryStoreManager store = new QueryStoreManager(testMongoClientProvider.mongoClient);
+    private TestMongoClientProvider testMongoClientProvider;
+    private QueryStoreManager store;
     private static final TestVaultImplementation testVaultImplementation = new TestVaultImplementation();
 
     @BeforeClass
@@ -341,6 +341,7 @@ public static void cleanUpClass()
     public void setup()
     {
         this.testMongoClientProvider = new TestMongoClientProvider();
+        this.store = new QueryStoreManager(this.testMongoClientProvider.mongoClient);
     }
 
     @After

legend-engine-xts-iceberg/legend-engine-xt-iceberg-test-support/pom.xml

@@ -124,11 +124,38 @@
             <artifactId>minio</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp-jvm</artifactId>
+        </dependency>
+
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>jcl-over-slf4j</artifactId>
             <scope>test</scope>
         </dependency>
 
     </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>dependency-analyze</id>
+                        <configuration>
+                            <!-- Needed on the compile classpath (minio's okhttp 5.x Maven
+                                 artifact is an empty multiplatform shim; classes are in
+                                 okhttp-jvm) but leaves no bytecode reference -->
+                            <ignoredUnusedDeclaredDependencies>
+                                <dependency>com.squareup.okhttp3:okhttp-jvm</dependency>
+                            </ignoredUnusedDeclaredDependencies>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
 </project>

legend-engine-xts-sql/legend-engine-xt-sql-postgres-server/pom.xml

@@ -293,7 +293,6 @@
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-util</artifactId>
-            <version>9.4.44.v20210927</version>
         </dependency>
         <dependency>
             <groupId>io.prometheus</groupId>

pom.xml

@@ -155,8 +155,8 @@
         <hikaricp.version>7.0.2</hikaricp.version>
         <h2.version>2.1.214</h2.version>
         <mariadb.version>3.0.6</mariadb.version>
-        <postgres.version>42.7.4</postgres.version>
-        <redshiftJDBC.version>2.0.0.3</redshiftJDBC.version>
+        <postgres.version>42.7.12</postgres.version>
+        <redshiftJDBC.version>2.2.2</redshiftJDBC.version>
         <snowflake.version>3.13.5</snowflake.version>
         <duckdb.version>1.3.0.0</duckdb.version>
         <clickhouse.version>0.9.6</clickhouse.version>
@@ -170,7 +170,7 @@
         <commons-codec.version>1.15</commons-codec.version>
         <commons-compress.version>1.21</commons-compress.version>
         <commons-csv.version>1.5</commons-csv.version>
-        <commons-io.version>2.7</commons-io.version>
+        <commons-io.version>2.16.1</commons-io.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
         <commons-text.version>1.10.0</commons-text.version>
         <deephaven.version>0.40.7</deephaven.version>
@@ -181,7 +181,7 @@
         <eclipsecollections.version>10.2.0</eclipsecollections.version>
         <flatbuffers-java.version>24.3.25</flatbuffers-java.version>
         <freemarker.version>2.3.34</freemarker.version>
-        <github.classgraph.version>4.8.25</github.classgraph.version>
+        <github.classgraph.version>4.8.184</github.classgraph.version>
         <google.api.grpc.version>2.21.0</google.api.grpc.version>
         <grpc.version>1.65.1</grpc.version>
         <guava.version>33.4.6-jre</guava.version>
@@ -199,16 +199,16 @@
         <javax.servlet.version>3.1.0</javax.servlet.version>
         <jaxrs.version>2.0.1</jaxrs.version>
         <jersey.version>2.25.1</jersey.version>
-        <jetty.version>9.4.44.v20210927</jetty.version>
+        <jetty.version>9.4.57.v20241219</jetty.version>
         <joda.time.version>2.10.14</joda.time.version>
-        <json-smart.version>2.4.7</json-smart.version>
+        <json-smart.version>2.5.2</json-smart.version>
         <jsonunit.version>2.17.0</jsonunit.version>
         <junit-jupiter.version>5.11.0</junit-jupiter.version>
         <junit.version>4.13.1</junit.version>
         <reload4j.version>1.2.19</reload4j.version>
         <logback-contrib.version>0.1.5</logback-contrib.version>
-        <logback.version>1.2.3</logback.version>
-        <minio.version>8.5.5</minio.version>
+        <logback.version>1.2.13</logback.version>
+        <minio.version>8.6.0</minio.version>
         <mockito-core.version>4.4.0</mockito-core.version>
         <mockito-inline.version>5.2.0</mockito-inline.version>
         <mongodb.version>5.3.1</mongodb.version>
@@ -219,7 +219,7 @@
         <pac4j.jersey.version>4.0.0</pac4j.jersey.version>
         <pac4j.version>4.5.8</pac4j.version>
         <prometheus.version>0.8.1</prometheus.version>
-        <protobuf.java.version>3.25.3</protobuf.java.version>
+        <protobuf.java.version>3.25.5</protobuf.java.version>
         <slf4j.version>1.7.36</slf4j.version>
         <snakeyaml.version>1.33</snakeyaml.version>
         <swagger.annotation.version>1.5.20</swagger.annotation.version>
@@ -243,7 +243,7 @@
         <maven.jar.plugin.version>3.1.2</maven.jar.plugin.version>
         <maven.javadoc.plugin.version>3.3.1</maven.javadoc.plugin.version>
         <maven.plugin.plugin.version>3.6.0</maven.plugin.plugin.version>
-        <maven.plugin.puppycrawl.version>8.25</maven.plugin.puppycrawl.version>
+        <maven.plugin.puppycrawl.version>8.29</maven.plugin.puppycrawl.version>
         <maven.resources.plugin.version>3.2.0</maven.resources.plugin.version>
         <maven.shade.plugin.version>3.4.1</maven.shade.plugin.version>
         <maven.source.plugin.version>3.2.0</maven.source.plugin.version>
@@ -4185,6 +4185,28 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <!-- minio 8.6+ depends on okhttp 5.x, whose "okhttp" Maven artifact is an
+                 empty Kotlin-multiplatform shim; the actual classes live in okhttp-jvm.
+                 Keep this version in sync with minio's okhttp requirement. -->
+            <dependency>
+                <groupId>com.squareup.okhttp3</groupId>
+                <artifactId>okhttp-jvm</artifactId>
+                <version>5.1.0</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>org.jetbrains</groupId>
+                        <artifactId>*</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
+            <!-- Pins minio's transitive bcprov-jdk18on (1.81 carries critical CVEs) up to
+                 the fixed line. The engine's own direct BouncyCastle usage is the separate
+                 legacy bcprov-jdk15on artifact, to be migrated to -jdk18on independently. -->
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>1.84</version>
+            </dependency>
             <!-- Test Containers -->
 
             <dependency>