fix: exclude vulnerable SnakeYAML from Cassandra storage

[FrankChen021]

What changed

• remove the Cassandra storage module's local dependency-management pin for org.yaml:snakeyaml:1.33
• exclude SnakeYAML from the transitive astyanax -> cassandra-all dependency chain

Why

Dependabot alert #297 reports a constructor-deserialization vulnerability in SnakeYAML 1.33. The Cassandra storage extension was overriding Druid's root dependency management to keep this vulnerable version in its runtime graph.

Cassandra 1.0.8 uses old SnakeYAML APIs that were removed in SnakeYAML 2.x, including org.yaml.snakeyaml.Loader and Constructor(Class). Replacing 1.33 with the root-managed 2.5 would therefore leave binary-incompatible server-configuration classes on the classpath.

The Druid extension uses Astyanax's Cassandra client/thrift APIs and does not use Cassandra's YAML server-configuration loader. Excluding this unused transitive dependency removes the vulnerable artifact without introducing a knowingly incompatible replacement.

Impact

The Cassandra storage extension no longer packages SnakeYAML through Astyanax/Cassandra. Other modules and root dependency management are unchanged.

Verification

• mvn -ntp dependency:tree -pl extensions-contrib/cassandra-storage -Dincludes=org.yaml:snakeyaml -Pskip-static-checks -Dweb.console.skip=true -T1C
  • succeeds with no SnakeYAML artifact in the module dependency tree
• mvn -ntp test -pl extensions-contrib/cassandra-storage -Pskip-static-checks -Dweb.console.skip=true -T1C
  • succeeds and compiles all six module source files
• git diff --check

Caveat

This module has no test sources, and validation does not connect to a live Cassandra cluster. The change is intentionally limited to an unused Cassandra server-side YAML dependency.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Removes a vulnerable SnakeYAML version from the Cassandra storage extension by dropping a local version pin and excluding SnakeYAML from the Astyanax/Cassandra dependency chain.

Changes:

• Removed module-level dependencyManagement pin for org.yaml:snakeyaml:1.33
• Added a Maven exclusion to prevent transitive inclusion of org.yaml:snakeyaml

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[FrankChen021]

I have reviewed the code for correctness, edge cases, concurrency, and integration risks; no issues found.

Reviewed 1 of 1 changed files.

---

This is an automated review by Codex GPT-5.6-Sol