From 1a7e3fa45c73ad2c1750d9a47ce0a86f98c1cd56 Mon Sep 17 00:00:00 2001
From: Baodi Shi <baodi@apache.org>
Date: Mon, 15 Jun 2026 17:06:32 +0800
Subject: [PATCH] Fix cves

---
 .github/workflows/trivy.yaml | 30 +++++++++++++
 image/Dockerfile             |  3 ++
 pom.xml                      | 82 +++++++++++++++++++++++++++++++++---
 3 files changed, 109 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/trivy.yaml

diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
new file mode 100644
index 00000000..efb446bc
--- /dev/null
+++ b/.github/workflows/trivy.yaml
@@ -0,0 +1,30 @@
+name: Trivy Scan
+on:
+  workflow_dispatch:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Scan CVEs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy vulnerability scanner in fs mode
+        uses: aquasecurity/trivy-action@v0.35.0
+        with:
+          scan-type: 'fs'
+          scan-ref: './'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '1'
+          format: table
+          scanners: "vuln"
+          args: --timeout 10m
+        env:
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
+          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
diff --git a/image/Dockerfile b/image/Dockerfile
index aa9ce43e..8d3c0456 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -19,4 +19,7 @@
 
 ARG PULSAR_VERSION
 FROM streamnative/pulsar-functions-java-runner:${PULSAR_VERSION}
+USER root
+RUN apk upgrade --no-cache
+USER $UID
 COPY --chown=$UID:$GID target/*.nar /pulsar/connectors/
diff --git a/pom.xml b/pom.xml
index 2110051d..58f102b8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,23 +48,23 @@
     <jackson.version>2.18.6</jackson.version>
     <jackson-databind.version>2.18.6</jackson-databind.version>
     <lombok.version>1.18.42</lombok.version>
-    <pulsar.version>4.2.0.6</pulsar.version>
+    <pulsar.version>4.2.1.1</pulsar.version>
     <jclouds-shaded.version>4.0.4.2</jclouds-shaded.version>
     <avro.version>1.12.0</avro.version>
     <hadoop.version>3.3.6</hadoop.version>
-    <parquet.version>1.13.1</parquet.version>
+    <parquet.version>1.15.2</parquet.version>
     <awsjavasdk.version>1.12.788</awsjavasdk.version>
     <aws.java.sdk2.version>2.32.28</aws.java.sdk2.version>
     <jaxb-api>2.3.1</jaxb-api>
     <gson.version>2.13.2</gson.version>
     <commons-compress.version>1.28.0</commons-compress.version>
-    <log4j.version>2.17.1</log4j.version>
+    <log4j.version>2.25.4</log4j.version>
     <json-smart.version>2.4.9</json-smart.version>
     <protobuf3.version>3.25.5</protobuf3.version>
     <protoc3.version>${protobuf3.version}</protoc3.version>
     <grpc.version>1.75.0</grpc.version>
     <protoc-gen-grpc-java.version>${grpc.version}</protoc-gen-grpc-java.version>
-    <azure-sdk-bom.version>1.2.22</azure-sdk-bom.version>
+    <azure-sdk-bom.version>1.2.30</azure-sdk-bom.version>
 
     <!-- test dependencies -->
     <junit.version>4.13.1</junit.version>
@@ -87,8 +87,21 @@
     <snakeyaml.version>2.0</snakeyaml.version>
     <reload4j.version>1.2.24</reload4j.version>
     <woodstox-core.version>5.4.0</woodstox-core.version>
-    <netty.version>4.1.133.Final</netty.version>
-    <libthrift.version>0.17.0</libthrift.version>
+    <netty.version>4.1.135.Final</netty.version>
+    <libthrift.version>0.23.0</libthrift.version>
+
+    <!-- transitive dependency overrides for CVE fixes -->
+    <jettison.version>1.5.4</jettison.version>
+    <snappy-java.version>1.1.10.4</snappy-java.version>
+    <nimbus-jose-jwt.version>9.37.4</nimbus-jose-jwt.version>
+    <dnsjava.version>3.6.0</dnsjava.version>
+    <commons-beanutils.version>1.11.0</commons-beanutils.version>
+    <guava.version>32.0.0-jre</guava.version>
+    <commons-configuration2.version>2.15.0</commons-configuration2.version>
+    <opentelemetry.version>1.62.0</opentelemetry.version>
+    <vertx.version>4.5.27</vertx.version>
+    <async-http-client.version>2.15.0</async-http-client.version>
+    <wire.version>6.3.0</wire.version>
   </properties>
 
   <licenses>
@@ -325,6 +338,63 @@
         <version>${libthrift.version}</version>
       </dependency>
 
+      <!-- transitive overrides for CVE fixes -->
+      <dependency>
+        <groupId>org.codehaus.jettison</groupId>
+        <artifactId>jettison</artifactId>
+        <version>${jettison.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.xerial.snappy</groupId>
+        <artifactId>snappy-java</artifactId>
+        <version>${snappy-java.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.nimbusds</groupId>
+        <artifactId>nimbus-jose-jwt</artifactId>
+        <version>${nimbus-jose-jwt.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>dnsjava</groupId>
+        <artifactId>dnsjava</artifactId>
+        <version>${dnsjava.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>commons-beanutils</groupId>
+        <artifactId>commons-beanutils</artifactId>
+        <version>${commons-beanutils.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-configuration2</artifactId>
+        <version>${commons-configuration2.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-api</artifactId>
+        <version>${opentelemetry.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.vertx</groupId>
+        <artifactId>vertx-core</artifactId>
+        <version>${vertx.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.asynchttpclient</groupId>
+        <artifactId>async-http-client</artifactId>
+        <version>${async-http-client.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.squareup.wire</groupId>
+        <artifactId>wire-runtime</artifactId>
+        <version>${wire.version}</version>
+      </dependency>
+
     </dependencies>
   </dependencyManagement>