NIFI-11663: Bump flyway-core version to 9.19.3

[r-sidd]

Summary

NIFI-11663

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using mvn clean install -P contrib-check
  • JDK 11
  • JDK 17

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[pvillard31]

I'd be very careful about this. Upgrading flyway to another major release could impact the range of database versions we support for NiFi Registry and how we deal with the internal H2 database. @bbende - do you have thoughts on this?

[exceptionfactory]

I'd be very careful about this. Upgrading flyway to another major release could impact the range of database versions we support for NiFi Registry and how we deal with the internal H2 database. @bbende - do you have thoughts on this?

I agree, this is a major version upgrade, and the Flyway change log highlights several database version adjustments. It does add support for more recent versions in some cases. This needs to be evaluated manually with the Registry integration tests to ensure those work as expected.

[bbende]

Yea this is tricky. I wonder if we should consider migrating to Liquibase for 2.0.0 since it doesn't seem to be as restrictive with dropping versions, but I'm not exactly sure how an upgrade would work where there is an existing DB that Liquibase needs to take control, although I think you can setup the migrations to skip stuff that is already there.

[exceptionfactory]

Flyway 9.0.0 dropped support for MariaDB 10.2, which results in failing database integration tests for NiFi Registry.

MariaDB 10.2.44 was the last version planned for the version 10.2 series, so that version is officially end of life. From that perspective, we should consider raising the minimum version of MariaDB to a more recent version, which could allow this upgrade to go forward.

However, until we update the minimum supported MariaDB versions and associated tests, the upgrade to Flyway 9 cannot go forward.

The two vulnerabilities mentioned in the NiFi Jira issue impact PostgreSQL and do not apply to Flyway, so this is not a direct security concern.

A separate NiFi Jira issue should be used to review supported minimum database versions, and then the Flyway upgrade can be re-evaluated.