fix(security): cherry-pick CRITICAL/HIGH dep bumps to 1.12.7

[sonika-shah]

Summary

Cherry-picks the security dependency bumps from main that are missing on 1.12.7. Addresses the May 8 2026 Snyk scan against 1.12.7. Backend Maven build verified locally (mvn clean install -DskipTests passes).

• 3300b9a — fix(security): upgrade Java dependencies to resolve CRITICAL and HIGH CVEs (#27940) (cherry-pick of 339b3dfb18 from main)
• 742e5e4 — Chore(deps): Bump ch.qos.logback:logback-core from 1.5.19 to 1.5.25 in /openmetadata-service (#25523) (cherry-pick of 6724762eb7 from main)

Vulnerabilities resolved (9 of 29 from the 1.12.7 Snyk report)

Severity	Module	Before	After
CRITICAL	org.eclipse.jetty:jetty-http (root pom)	12.1.6	12.1.7 — HTTP Request Smuggling (CVE-2026-2332)
HIGH	org.postgresql:postgresql	42.7.7	42.7.11 — SCRAM-SHA-256 DoS (CVE-2026-42198)
HIGH	org.bouncycastle:bcprov-jdk18on	(unpinned, transitive 1.80)	1.84 — Crypto Signature Bypass + Timing Attack (CVE-2026-5598)
HIGH	org.eclipse.angus:smtp	2.0.4	(already at fix version, will clear on rebuild) — CVE-2025-7962
MED	org.bouncycastle:bcprov-jdk18on	(transitive)	1.84 — CVE-2026-0636
MED	org.bouncycastle:bcpkix-jdk18on	(transitive)	1.84 — CVE-2026-5588
MED	com.fasterxml.jackson.core:jackson-core	2.17.2	2.18.7 — GHSA-72hv-8253-57qq
MED	ch.qos.logback:logback-core	1.5.19	1.5.25 — CVE-2025-11226
LOW	ch.qos.logback:logback-core	1.5.19	1.5.25 — CVE-2026-1225

Other library bumps included (not security-flagged on 1.12.7 but came along with the cherry-pick)

These are part of the original 339b3dfb18 security PR on main. Listed for transparency:

• gson 2.11.0 → 2.13.1
• spring 6.2.11 → 6.2.18
• New pins: httpcore5-h2 5.3.5, commons-compress 1.26.0
• logback-classic 1.5.18 → 1.5.25 (paired with logback-core)

Conflict resolutions

• Jackson (pom.xml:76): 1.12.7 was at 2.17.2, cherry-pick targets 2.18.7. Took the cherry-pick's value to satisfy GHSA-72hv-8253-57qq. The 2.17.2 → 2.18.7 jump is the same delta main absorbed.
• org.junit.platform.version property (pom.xml:113): the cherry-pick removes this unused property. Verified via git grep '${org.junit.platform.version}' that nothing on 1.12.7 references it. Safe to drop.
• openmetadata-service jetty.version (openmetadata-service/pom.xml:34): 1.12.7 was already at 12.1.7 (newer than the cherry-pick's 12.1.1). Kept the newer value.

Still open on 1.12.7 (out of scope for this PR — separate follow-ups)

• HIGH ×5 + MED ×4 + LOW ×1 netty-codec-* and netty-transport-native-epoll — all retired by netty-bom 4.1.132 → 4.1.133. Tracked on main in #27994; cherry-pick to 1.12.7 once it merges.
• HIGH ×2 + MED ×1 log4j-core 2.25.3 (Rfc5424Layout / XmlLayout / Log4j1XmlLayout) — covered by #27994 bumping to 2.25.4; cherry-pick after merge.
• MED jsonschema2pojo 1.2.2 → 1.3.0 (CVE-2025-3588) — covered by #27994.
• MED azure-identity 1.14.0 → 1.15.2 (CVE-2024-35255) — covered by #27994.
• HIGH awssdk:cloudfront (GHSA-443w-3rq3-5m5h) — needs separate verification of awssdk version.
• MED reactor-netty-http 1.2.14 (CVE-2025-22227) — needs separate verification.
• HIGH lcms2 (CVE-2026-41254) — Alpine OS package, handled by Docker apk upgrade, not Maven.
• MED jgit (CVE-2025-4949) and MED eddsa (CVE-2020-36843) — confirmed via chore(security): bump deps to address reported CVEs #27994's PR description not in OpenMetadata's Maven tree (likely Airflow base image or stale scan).

Test plan

• Backend Maven build passes locally (mvn clean install -DskipTests -pl '!openmetadata-ui,!openmetadata-ui-core-components' -am)
• CI green
• mvn dependency:tree confirms resolved versions:
  • jetty-http → 12.1.7
  • postgresql → 42.7.11
  • bc{pkix,prov,util}-jdk18on → 1.84
  • jackson-core → 2.18.7
  • logback-{core,classic} → 1.5.25
• Re-run Snyk on a freshly built 1.12.7 image; the 9 listed findings should clear

🤖 Generated with Claude Code

---

Summary by Gitar

• Dependency updates:
  • Upgraded jackson, gson, logback, and jetty versions in root pom.xml.
  • Added explicit pins for httpcore5-h2, commons-compress, and bouncycastle libraries.
• SDK and Tooling:
  • Aligned junit-jupiter and junit-platform versions in openmetadata-sdk.
  • Upgraded maven-shade-plugin to 3.6.0 in elasticsearch-dep and opensearch-dep.
  • Added custom OpenAPI template directory configuration in openmetadata-java-client.

_{This will update automatically on new commits.}

[github-actions]

The Python checkstyle failed.

Please run make py_format and py_format_check in the root of your repository and commit the changes to this PR.
You can also use pre-commit to automate the Python code formatting.

You can install the pre-commit hooks with make install_test precommit_install.

[sonika-shah]

Update: pre-existing 1.12.7 SDK test discovery bug + fix

The openmetadata-service-unit-tests (postgresql) failure on the first CI run is not introduced by this PR — it's a pre-existing bug on the 1.12.7 branch that was latent because the bare-branch CI never runs the unit-test workflow (it only fires on pull_request events).

Reproduction on origin/1.12.7 HEAD (no PR changes)

$ git checkout origin/1.12.7
$ mvn -pl openmetadata-sdk -am test
[ERROR] Failed to execute goal ... maven-surefire-plugin:3.1.2:test on project openmetadata-sdk:
  org.junit.platform.commons.JUnitException: TestEngine with ID 'junit-jupiter' failed to discover tests:
  ClassSelector [className = 'org.openmetadata.sdk.OMStorageServicesInitTest', ...]
  resolution failed: 'boolean org.junit.platform.commons.util.ReflectionUtils.returnsVoid(java.lang.reflect.Method)'

Root cause

openmetadata-sdk/pom.xml on 1.12.7 hard-pins:

<junit.version>5.9.3</junit.version>
<junit-platform.version>1.9.3</junit-platform.version>

…but the parent pom imports org.junit:junit-bom:5.11.4 in dependencyManagement, which overrides transitive deps to junit-platform-commons:1.11.4. junit-platform-commons 1.11 made ReflectionUtils.returnsVoid(Method) non-public, while junit-jupiter-engine:5.9.3 still calls it publicly → JUnitException during test discovery.

mvn dependency:tree confirms the skew on both PR and base:

+- org.junit.jupiter:junit-jupiter:jar:5.9.3:test               ← direct, hard-pinned
|  +- org.junit.jupiter:junit-jupiter-api:jar:5.11.4:test       ← transitive, BOM-overridden
|  |  \- org.junit.platform:junit-platform-commons:jar:1.11.4   ← transitive, BOM-overridden
\- org.junit.jupiter:junit-jupiter-engine:jar:5.9.3:test        ← direct, hard-pinned
   \- org.junit.platform:junit-platform-engine:jar:1.11.4       ← transitive, BOM-overridden

Fix (commit fb91bbcf)

Match what main already does — derive junit.version from the parent's ${org.junit.jupiter.version} so direct + transitive deps stay aligned:

- <junit.version>5.9.3</junit.version>
- <junit-platform.version>1.9.3</junit-platform.version>
+ <junit.version>${org.junit.jupiter.version}</junit.version>
+ <junit-platform.version>1.11.4</junit-platform.version>

Verified locally:

[INFO] Tests run: 195, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS

🤖 Generated with Claude Code

[github-actions]

The Python checkstyle failed.

Please run make py_format and py_format_check in the root of your repository and commit the changes to this PR.
You can also use pre-commit to automate the Python code formatting.

You can install the pre-commit hooks with make install_test precommit_install.

[github-actions]

The Python checkstyle failed.

Please run make py_format and py_format_check in the root of your repository and commit the changes to this PR.
You can also use pre-commit to automate the Python code formatting.

You can install the pre-commit hooks with make install_test precommit_install.

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Cherry-picks critical security dependency upgrades including Jetty, PostgreSQL, BouncyCastle, and Jackson to resolve multiple high-severity vulnerabilities. Conflicts with the child module commons-compress versioning were successfully resolved.

✅ 1 resolved

✅ Quality: commons-compress pinned at 1.26.0 conflicts with child module

📄 pom.xml:725-727
The new commons-compress pin at version 1.26.0 (pom.xml line 726) is outdated (latest is 1.28.0) and conflicts with openmetadata-mcp/pom.xml which declares 1.27.1. Since child <dependencyManagement> entries take precedence over parent for that module, the effective version will be inconsistent across the build. Consider bumping to at least 1.27.1 (or 1.28.0) for consistency and to pick up additional fixes.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

The Python checkstyle failed.

Please run make py_format and py_format_check in the root of your repository and commit the changes to this PR.
You can also use pre-commit to automate the Python code formatting.

You can install the pre-commit hooks with make install_test precommit_install.