fix: address Jackson 1 and Netty vulnerabilities

[FrankChen021]

Related

Supersedes #18456.

Summary

• remove the unused Jackson 1 version property and dependency-management entries
• remove the explicit test-scope jackson-core-asl and jackson-mapper-asl dependencies from ambari-metrics-emitter
• remove the now-obsolete OWASP suppression for jackson-mapper-asl
• retain the Ambari transitive exclusions that prevent Jackson 1 core/mapper from entering the production dependency graph
• upgrade the managed Netty 4 version from 4.2.15.Final to 4.2.16.Final
• suppress findings for the EOL Netty 3 artifact as a package until Druid's NettyHttpClient is migrated to Netty 4

Root cause

Dependabot alerts #2 and #221 report org.codehaus.jackson:jackson-mapper-asl:1.9.13. Jackson 1 is end-of-life and has no patched release. The Ambari Metrics dependency already excluded Jackson 1 core and mapper from production, but the module explicitly added both artifacts back in test scope. The root POM also kept global dependency-management entries for them.

Druid's Ambari emitter source and tests use Jackson 2 (com.fasterxml.jackson), so the explicit Jackson 1 test dependencies are unnecessary.

Why the Netty changes are included

Removing the obsolete Jackson suppression changes owasp-dependency-check-suppressions.xml, which is the path trigger for Druid's full OWASP dependency-check workflow. That repository-wide scan exposed two pre-existing Netty findings that were not introduced by the Jackson cleanup:

• Netty 4.2.15.Final can be updated directly, so this PR moves all BOM-managed Netty 4 components to 4.2.16.Final.
• Netty 3.10.6.Final is EOL. It cannot be upgraded to a patched Netty 3 release, and moving it to Netty 4 requires replacing Druid's legacy NettyHttpClient. The existing suppression already documented that migration requirement, so it is made package-wide instead of adding each newly assigned CVE individually.

Including these changes allows the security workflow triggered by this PR to assess the Jackson removal without failing on unrelated baseline Netty findings. It also fixes the actionable Netty 4 finding while keeping the larger Netty 3-to-4 migration explicit.

Impact

The Ambari emitter no longer resolves jackson-core-asl or jackson-mapper-asl, allowing Dependabot alerts #2 and #221 to close without hiding an active vulnerable dependency. Runtime behavior is unchanged because those artifacts were already excluded from the production Ambari dependency path.

Netty 4 consumers use 4.2.16.Final consistently. Netty 3 remains unchanged at runtime; only its OWASP reporting is consolidated pending the required client migration.

Validation

• mvn -ntp dependency:tree -pl extensions-contrib/ambari-metrics-emitter -Dincludes=org.codehaus.jackson -Dverbose -Pskip-static-checks -Dweb.console.skip=true -T1C
  • confirms neither jackson-core-asl nor jackson-mapper-asl is resolved; Ambari's separate jackson-xc artifact remains
• mvn -ntp test -pl extensions-contrib/ambari-metrics-emitter -Pskip-static-checks -Dweb.console.skip=true -T1C
  • 28 tests passed
• mvn -ntp dependency:tree -pl processing,extensions-contrib/grpc-query -Dincludes=io.netty -Pskip-static-checks -Dweb.console.skip=true -T1C
  • confirms all BOM-managed Netty 4 artifacts resolve to 4.2.16.Final
• mvn -ntp test -pl processing,extensions-contrib/grpc-query -DskipTests -Pskip-static-checks -Dweb.console.skip=true -T1C
  • main and test compilation passed for both modules
• updated the Netty and Netty tcnative entries in licenses.yaml to match the versions resolved by the Netty 4.2.16 BOM
• validated owasp-dependency-check-suppressions.xml against Dependency-Check's dependency-suppression.1.3.xsd
• git diff --check

The focused local OWASP run could not execute without a populated NVD database; the GitHub security workflow provides the authoritative rescan with its configured NVD access.

Caveats

This intentionally does not upgrade Ambari or alter its binary API. The existing exclusions remain in place to prevent its transitive Jackson 1 core/mapper dependencies from returning.

The Netty 3 suppression is not a claim that Netty 3 is patched. It records that no patched Netty 3 line exists and that remediation requires the separate NettyHttpClient migration to Netty 4.

Created by GPT-5.6-Sol.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Removes end-of-life Jackson 1 (org.codehaus.jackson) dependencies and related OWASP suppression to close Dependabot alerts while preserving existing transitive exclusions that keep Jackson 1 out of the production dependency graph.

Changes:

• Removed the unused Jackson 1 version property and dependency-management entries from the root POM.
• Removed explicit test-scope jackson-core-asl / jackson-mapper-asl dependencies from extensions-contrib/ambari-metrics-emitter.
• Removed the now-obsolete OWASP Dependency-Check suppression for jackson-mapper-asl:1.9.13.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pom.xml	Removes Jackson 1 version property and dependency-management entries to prevent resolution of vulnerable artifacts.
owasp-dependency-check-suppressions.xml	Drops suppression that was only needed due to test-scope Jackson 1 usage.
extensions-contrib/ambari-metrics-emitter/pom.xml	Removes explicit test dependencies on Jackson 1 core/mapper artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[FrankChen021]

The failing KafkaIndexFaultToleranceTest.test_supervisorRecords_afterHistoricalRestart appears to be an unrelated flaky-test failure caused by publishing immediately after topic creation, before all partition leaders are ready. PR #19824 adds the topic-leader readiness wait and includes focused regression coverage for this scenario.

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

Reviewed 4 of 4 changed files.

---

This is an automated review by Codex GPT-5.6-Sol

[FrankChen021]

[P1] Keep future Netty 3 advisories visible

This wildcard suppresses every current and future vulnerability reported for io.netty:netty:3.10.6.Final. Druid still executes this EOL dependency through NettyHttpClient, so a newly disclosed vulnerability affecting an actual runtime path would silently pass the OWASP CI scan. Please retain individually assessed CVE suppressions, optionally with suppressUntil, so new advisories remain visible and trigger assessment or migration.