[deps] Tier 1: drop-in Java 1.8 version bumps for 19 vulnerable GAVs (closes 153 CVEs)

[natechadwick-intsof]

Summary

OWASP dependency-check on the main branch (Java 1.8 build target) reports 657 CVE matches across 136 unique Maven GAVs. Of those, 19 GAVs (153 CVEs) can be closed by a drop-in <version> bump in the root pom.xml with a fix that is verified Java 1.8 compatible (bytecode major version ≤ 52 or Java 9 bytecode that runs on Java 8+). No source-code changes are expected for any of these bumps.

This issue tracks getting all 19 upgrades merged.

Why

• 19 GAVs is the single highest-ROI win in the whole dependency report. The other 117 GAVs either require a Java 11+ migration or are at the latest Java 1.8 line.
• The biggest single move is jackson.version=2.21.5 in the root pom, which closes 80 CVEs by itself.
• None of the proposed fix versions introduce a bytecode level that breaks the Java 1.8 build (each was bytecode-verified on Maven Central against the current JDK 1.8.0_504).

List of upgrades

All version bumps go in the root pom.xml <properties> block (or per-module POMs if a property is overridden). The "current" version is what the project declares today; the "fix" version(s) are verified Java 1.8 compatible.

#	GAV	Current	Fix	CVEs closed	Severity
1	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.5	80	CRITICAL, HIGH
2	io.netty:netty-handler	4.1.99.Final	4.1.135.Final	10	HIGH, MODERATE
3	org.apache.zookeeper:zookeeper	3.6.2	3.7.2	9	CRITICAL, HIGH, MODERATE
4	org.yaml:snakeyaml	1.23	1.32 (or 2.0)	8	HIGH, MODERATE
5	org.apache.derby:derby	10.14.2.0	10.14.2.1	7	CRITICAL, HIGH
6	com.google.protobuf:protobuf-java	2.5.0	3.25.5	5	HIGH, MODERATE
7	io.netty:netty-codec	4.1.99.Final	4.1.136.Final	5	HIGH, MODERATE
8	com.fasterxml.jackson.core:jackson-core	2.21.1	2.21.4	4	HIGH, MODERATE
9	com.github.junrar:junrar	7.5.5	7.5.10	4	HIGH, MODERATE
10	org.xerial.snappy:snappy-java	1.1.10.1	1.1.10.4	4	HIGH, MODERATE
11	org.jsoup:jsoup	1.22.1	1.23.1	4	HIGH, MODERATE
12	org.apache.httpcomponents.client5:httpclient5	5.4.4	5.6.3	3	HIGH, MODERATE
13	org.eclipse.jetty:jetty-webapp	9.4.26.v20200117	9.4.33.v20201020	3	HIGH, MODERATE
14	io.netty:netty-common	4.1.99.Final	4.1.118.Final	2	MODERATE
15	com.sun.mail:jakarta.mail	1.6.7	1.6.8	1	MODERATE
16	io.netty:netty-transport-native-epoll	4.1.99.Final	4.1.135.Final	1	MODERATE
17	org.apache.httpcomponents.core5:httpcore5	5.3.4	5.4.3	1	HIGH
18	org.apache.httpcomponents.core5:httpcore5-h2	5.3.4	5.4.3	1	HIGH
19	org.apache.poi:poi-ooxml	5.2.2	5.4.0	1	MODERATE

Notes per row

• Support IMDSv2 for EC2 detection (Amazon Linux 2023+ S3 / Assume Role) #1 jackson-databind 2.21.1 → 2.21.5: highest ROI. The jackson.version property in the root pom controls this. No transitive API breaks between 2.21.1 and 2.21.5.
• Metadata extraction fails on unbound prefixes (e.g. gcse:search) during DTS publish #4 snakeyaml: 1.x is fine if any consumer still needs the old API. Otherwise jump straight to 2.0 (Java 8 compatible, no breaking change to typical usage).
• Linux 8.1.7: percussioncms service stop does not stop process; starts before DB on reboot #6 protobuf-java 2.5.0 → 3.25.5: a 7-year major jump. Worth a smoke test (especially around any .proto files compiled with the old protoc). The 3.25.5 jar is Java 8 bytecode (major 52).
• build(deps): bump the maven group across 4 directories with 22 updates #7 / Fix Dependency Submission workflow YAML syntax error #14 netty: there are many io.netty:netty-* artifacts in the pom. They all share a nettyall.version property; bumping the single property covers all of them. Verify netty-transport-native-epoll and netty-transport-classes-epoll line up.
• fix(rte): insert image selected from Assets folder (#11) #13 jetty-webapp 9.4.26 → 9.4.33: also bump jetty.version from 9.4.26 to 9.4.58 (the project already has 9.4.58.v20250814 in jetty.version; this row is just for the straggler jetty-webapp entry that wasn't aligned).
• fix(ci): resolve dependency-submission workflow YAML syntax error (#14) #15 jakarta.mail 1.6.7 → 1.6.8: note this is jakarta.mail (the older com.sun.mail:jakarta.mail artifact), not the jakarta.mail:jakarta.mail-api namespace.
• build(deps): bump the maven group across 3 directories with 20 updates #17/Dependabot not respecting Java 8 ignore list #18 httpcore5 5.3.4 → 5.4.3: keep httpcore5.version and httpcore5-h2.version in sync.

Acceptance criteria

• All 19 GAVs in the table above are upgraded to the listed fix version (or the next available patch if a newer one ships before this is merged; verify Java 1.8 compatibility first).
• ./mvn-env.sh clean install -DskipTests succeeds on Java 1.8.
• ./mvn-env.sh dependency-check:check reports a 19-GAV reduction in the "Dependency with vulnerable components" count.
• QA regression run on system and WebUI smoke tests passes.

Out of scope

• The remaining 117 GAVs flagged by OWASP dependency-check are tracked in the parent epic (separate issue).
• No code changes are expected for this issue; the bumps are version-only.

References

• Full analysis: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md
• Machine-readable per-GAV data: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json (key UPGRADE_JAVA8)
• Per-module OWASP HTML reports at <module>/target/dependency-check-report.html

[natechadwick-intsof]

Closing — Tier 1 plan complete.

The 19-GAV plan is 18 of 19 GAVs closed (13 in #79 + 5 deferred items that turned out to be already done by other work: snakeyaml 2.6, jsoup 1.23.1, jetty-webapp 9.4.58, netty-transport-native-epoll 4.1.136 via BOM, protobuf-java 4.33.2 via closure-compiler). The remaining 1 GAV (derby, 7 CVEs) is unfixable on Java 1.8 and has been reclassified into Tier 3.

Full accounting in #81. The Tier 2/Tier 3 work continues under the parent epic — see #73.

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.