chore: update vulnerable Maven dependencies

[ttalbert7]

Summary

Updates Maven dependency management to remove high and critical Snyk findings in the main Floci project and Java compatibility test project.

Changes include:

• Bump Quarkus from 3.36.0 to 3.36.3
• Add Jackson BOM management and remove direct jackson-databind version pinning
• Bump Apicurio within the compatible 2.x line from 2.6.9.Final to 2.6.13.Final
• Override vulnerable Wire runtime dependencies to 6.3.0
• Update Java compatibility test dependencies for AWS SDK, Netty, Jackson, PostgreSQL, Kafka, commons-lang3, and Wire

Snyk high-severity scans now report no vulnerable paths for:

• pom.xml
• compatibility-tests/sdk-test-java/pom.xml

Type of change

• Bug fix (fix:)
• New feature (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

AWS Compatibility

No AWS wire protocol behavior changed. This PR only updates dependency versions and dependency management.

Focused validation was run for the Glue schema compatibility path because the Apicurio/Wire updates affect schema registry dependencies.

Checklist

• ./mvnw test passes locally
• New or updated integration test added
• Commit messages follow Conventional Commits

[greptile-apps]

Greptile Summary

This PR updates Maven dependency management in both the main Floci project and the Java compatibility test project to eliminate high and critical Snyk vulnerability findings, with no changes to application logic or AWS wire protocol behavior.

• Main pom.xml: Quarkus 3.36.0→3.36.3, Apicurio 2.6.9.Final→2.6.13.Final, adds jackson-bom 2.21.4 and wire-runtime/wire-runtime-jvm 6.3.0 overrides in dependencyManagement.
• Compatibility test pom.xml: AWS SDK 2.42.24→2.44.14, Netty 4.1.118→4.1.135.Final, PostgreSQL 42.7.3→42.7.11; replaces the hard-pinned jackson-databind 2.18.2 with jackson-bom 2.18.8 import; adds Wire 6.3.0, commons-lang3 3.18.0, and kafka-clients 3.9.2 overrides.

Confidence Score: 5/5

Safe to merge — purely dependency version updates with no logic changes and local tests passing.

All changes are confined to dependencyManagement and direct version properties; no application code, configuration semantics, or wire-protocol behavior is touched. The jackson-bom is intentionally placed before quarkus-bom in the main POM so it wins the Maven import ordering contest, which is the correct approach for overriding a BOM-managed version. The author confirms ./mvnw test passes and Snyk shows no remaining vulnerable paths.

No files require special attention. The Jackson version divergence between the two projects (2.21.4 in main, 2.18.8 in compat tests) is expected given the different dependency stacks they operate in.

Important Files Changed

Filename	Overview
pom.xml	Bumps Quarkus 3.36.0→3.36.3, Apicurio 2.6.9→2.6.13.Final, adds jackson-bom 2.21.4 (placed before quarkus-bom so it wins the version contest), and adds wire-runtime/wire-runtime-jvm 6.3.0 overrides in dependencyManagement. No direct dependency or logic changes.
compatibility-tests/sdk-test-java/pom.xml	Bumps AWS SDK v2 2.42.24→2.44.14, Netty 4.1.118→4.1.135.Final, PostgreSQL 42.7.3→42.7.11. Replaces direct jackson-databind 2.18.2 pin with jackson-bom 2.18.8 import. Adds wire-runtime 6.3.0, commons-lang3 3.18.0, and kafka-clients 3.9.2 overrides to dependencyManagement.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph pom["pom.xml (main project)"]
        JB1["jackson-bom 2.21.4\n(import — wins first)"]
        QB["quarkus-bom 3.36.3\n(import)"]
        WR1["wire-runtime 6.3.0\n(override)"]
        WRJ1["wire-runtime-jvm 6.3.0\n(override)"]
        JB1 --> QB
    end

    subgraph compat["compatibility-tests/sdk-test-java/pom.xml"]
        AWSBOM["aws-sdk bom 2.44.14\n(import)"]
        NB["netty-bom 4.1.135.Final\n(import)"]
        JB2["jackson-bom 2.18.8\n(import)"]
        WR2["wire-runtime 6.3.0\n(override)"]
        WRJ2["wire-runtime-jvm 6.3.0\n(override)"]
        CL["commons-lang3 3.18.0\n(override)"]
        KC["kafka-clients 3.9.2\n(override)"]
        PG["postgresql 42.7.11\n(direct)"]
    end

    JB1 -.->|"Jackson 2.21.4\noverrides Quarkus BOM pin"| QB
    JB2 -.->|"Jackson 2.18.8\noverrides AWS SDK transitive"| AWSBOM

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    subgraph pom["pom.xml (main project)"]
        JB1["jackson-bom 2.21.4\n(import — wins first)"]
        QB["quarkus-bom 3.36.3\n(import)"]
        WR1["wire-runtime 6.3.0\n(override)"]
        WRJ1["wire-runtime-jvm 6.3.0\n(override)"]
        JB1 --> QB
    end

    subgraph compat["compatibility-tests/sdk-test-java/pom.xml"]
        AWSBOM["aws-sdk bom 2.44.14\n(import)"]
        NB["netty-bom 4.1.135.Final\n(import)"]
        JB2["jackson-bom 2.18.8\n(import)"]
        WR2["wire-runtime 6.3.0\n(override)"]
        WRJ2["wire-runtime-jvm 6.3.0\n(override)"]
        CL["commons-lang3 3.18.0\n(override)"]
        KC["kafka-clients 3.9.2\n(override)"]
        PG["postgresql 42.7.11\n(direct)"]
    end

    JB1 -.->|"Jackson 2.21.4\noverrides Quarkus BOM pin"| QB
    JB2 -.->|"Jackson 2.18.8\noverrides AWS SDK transitive"| AWSBOM

Loading

_{Reviews (2): Last reviewed commit: "chore: update vulnerable Maven dependenc..." | Re-trigger Greptile}

[hectorvent]

Thanks for putting this security sweep together, it ended up being the backbone of the consolidated dependency update in #1690, which merged yesterday. I verified against current main and every change here already landed through it: AWS SDK 2.44.14, netty 4.1.135.Final, the jackson boms, the wire runtime pins, kafka clients 3.9.2, commons lang3 3.18.0 and postgresql 42.7.11 are all in place. There is nothing left for this branch to add, so closing it as superseded. Appreciate the work, it shipped, just under a different number.