Bump Zookeeper to 3.9.5, Jackson to 2.21.1 (#3522)

* Remove GeoServer-specific versioning in gs-plugins to avoid false CVE warnings

Author: elahrvivaz

build/dependencies.txt

@@ -4,10 +4,10 @@ com.clearspring.analytics:stream:2.9.8:compile
 com.esotericsoftware:kryo-shaded:4.0.3:compile
 com.esotericsoftware:minlog:1.3.0:compile
 com.facebook:nailgun-server:1.0.1:compile
-com.fasterxml.jackson.core:jackson-annotations:2.19.0:compile
-com.fasterxml.jackson.core:jackson-core:2.19.0:compile
-com.fasterxml.jackson.core:jackson-databind:2.19.0:compile
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.19.0:compile
+com.fasterxml.jackson.core:jackson-annotations:2.21:compile
+com.fasterxml.jackson.core:jackson-core:2.21.1:compile
+com.fasterxml.jackson.core:jackson-databind:2.21.1:compile
+com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.1:compile
 com.github.ben-manes.caffeine:caffeine:3.1.8:compile
 com.github.luben:zstd-jni:1.5.5-11:compile
 com.github.pureconfig:pureconfig-core_2.12:0.17.4:compile
@@ -169,8 +169,8 @@ org.apache.thrift:libthrift:0.17.0:compile
 org.apache.xml:xml-commons-resolver:1.2:compile
 org.apache.yetus:audience-annotations:0.12.0:compile
 org.apache.yetus:audience-annotations:0.13.0:compile
-org.apache.zookeeper:zookeeper-jute:3.9.4:compile
-org.apache.zookeeper:zookeeper:3.9.4:compile
+org.apache.zookeeper:zookeeper-jute:3.9.5:compile
+org.apache.zookeeper:zookeeper:3.9.5:compile
 org.apiguardian:apiguardian-api:1.1.2:compile
 org.calrissian.mango:mango-core:3.0.0:compile
 org.checkerframework:checker-qual:2.5.2:compile
@@ -288,13 +288,13 @@ com.amazonaws:jmespath-java:1.12.793:provided
 com.datastax.cassandra:cassandra-driver-core:3.11.5:provided
 com.datastax.cassandra:cassandra-driver-mapping:3.11.5:provided
 com.eclipsesource.minimal-json:minimal-json:0.9.5:provided
-com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.19.0:provided
-com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.19.0:provided
-com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:2.19.0:provided
-com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:2.19.0:provided
-com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.19.0:provided
-com.fasterxml.jackson.module:jackson-module-scala_2.12:2.19.0:provided
-com.fasterxml.woodstox:woodstox-core:7.1.0:provided
+com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.21.1:provided
+com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.21.1:provided
+com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:2.21.1:provided
+com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:2.21.1:provided
+com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.21.1:provided
+com.fasterxml.jackson.module:jackson-module-scala_2.12:2.21.1:provided
+com.fasterxml.woodstox:woodstox-core:5.4.0:provided
 com.github.jnr:jffi:1.2.16:provided
 com.github.jnr:jffi:native:1.2.16:provided
 com.github.jnr:jnr-constants:0.9.9:provided
@@ -305,7 +305,6 @@ com.github.pjfanning:jersey-json:1.22.0:provided
 com.github.stephenc.jcip:jcip-annotations:1.0-1:provided
 com.google.code.findbugs:jsr305:3.0.2:provided
 com.google.crypto.tink:tink:1.9.0:provided
-com.google.errorprone:error_prone_annotations:2.36.0:provided
 com.google.inject.extensions:guice-servlet:4.2.3:provided
 com.google.inject:guice:4.2.3:provided
 com.jcraft:jsch:0.1.55:provided
@@ -372,7 +371,6 @@ org.antlr:antlr4-runtime:4.7.1:provided
 org.apache.accumulo:accumulo-start:2.1.4:provided
 org.apache.avro:avro-ipc:1.11.4:provided
 org.apache.avro:avro-mapred:1.11.4:provided
-org.apache.commons:commons-lang3:3.18.0:provided
 org.apache.commons:commons-math3:3.6.1:provided
 org.apache.commons:commons-vfs2:2.9.0:provided
 org.apache.datasketches:datasketches-java:3.3.0:provided
@@ -449,11 +447,10 @@ org.apache.tomcat:tomcat-util-scan:9.0.104:provided
 org.apache.tomcat:tomcat-util:9.0.104:provided
 org.apache.xbean:xbean-asm9-shaded:4.23:provided
 org.bouncycastle:bcprov-jdk18on:1.78.1:provided
-org.checkerframework:checker-qual:3.49.5:provided
 org.codehaus.janino:commons-compiler:3.1.9:provided
 org.codehaus.janino:janino:3.1.9:provided
 org.codehaus.jettison:jettison:1.5.4:provided
-org.codehaus.woodstox:stax2-api:4.2.2:provided
+org.codehaus.woodstox:stax2-api:4.2.1:provided
 org.eclipse.angus:angus-activation:2.0.1:provided
 org.eclipse.jetty.websocket:websocket-api:9.4.57.v20241219:provided
 org.eclipse.jetty.websocket:websocket-client:9.4.57.v20241219:provided

docs/user/upgrade/6.0.0.rst

@@ -34,6 +34,7 @@ The following dependencies have been upgraded:
 * commons-logging ``1.3.3`` -> ``1.3.5``
 * commons-text ``1.12.0`` -> ``1.13.0``
 * geotools ``33.2`` -> ``34.2``
+* jackson ``2.19.0`` -> ``2.21.1``
 * kafka ``3.9.0`` -> ``3.9.1``
 * micrometer ``1.15.4`` -> ``1.16.0``
 * nifi ``2.6.0`` -> ``2.7.2``
@@ -44,7 +45,7 @@ The following dependencies have been upgraded:
 * scala 2.13 ``2.13.12`` -> ``2.13.16``
 * sedona ``1.8.0`` -> ``1.8.1``
 * spark ``3.5.5`` -> ``3.5.7``
-* zookeeper ``3.9.3`` -> ``3.9.4``
+* zookeeper ``3.9.3`` -> ``3.9.5``
 
 StrategyDecider API Update
 --------------------------

geomesa-archetypes/geomesa-archetypes-gs-plugin/pom.xml

@@ -13,98 +13,78 @@
     <packaging>pom</packaging>
 
     <properties>
-        <gs.antlr.version>4.7.1</gs.antlr.version>
-        <gs.checker.qual.version>3.49.5</gs.checker.qual.version>
-        <gs.commons.codec.version>1.18.0</gs.commons.codec.version>
-        <gs.commons.io.version>2.19.0</gs.commons.io.version>
-        <gs.commons.lang3.version>3.18.0</gs.commons.lang3.version>
-        <gs.commons.logging.version>1.3.5</gs.commons.logging.version>
-        <gs.commons.pool.version>1.5.4</gs.commons.pool.version>
-        <gs.commons.text.version>1.13.0</gs.commons.text.version>
-        <gs.error.prone.version>2.36.0</gs.error.prone.version>
-        <gs.jackson.version>2.19.0</gs.jackson.version>
-        <gs.jackson.databind.version>2.19.0</gs.jackson.databind.version>
+        <antlr.version>4.7.1</antlr.version>
+        <commons.pool.version>1.5.4</commons.pool.version>
     </properties>
 
     <dependencyManagement>
         <dependencies>
             <!-- dependencies already in geoserver -->
+            <!-- note: these versions don't align with the actual versions in the geoserver war -->
             <dependency>
                 <groupId>commons-codec</groupId>
                 <artifactId>commons-codec</artifactId>
-                <version>${gs.commons.codec.version}</version>
+                <version>${commons.codec.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>${gs.commons.io.version}</version>
+                <version>${commons.io.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-lang3</artifactId>
-                <version>${gs.commons.lang3.version}</version>
+                <version>${commons.lang3.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>commons-logging</groupId>
                 <artifactId>commons-logging</artifactId>
-                <version>${gs.commons.logging.version}</version>
+                <version>${commons.logging.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>commons-pool</groupId>
                 <artifactId>commons-pool</artifactId>
-                <version>${gs.commons.pool.version}</version>
+                <version>${commons.pool.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-text</artifactId>
-                <version>${gs.commons.text.version}</version>
-                <scope>provided</scope>
-            </dependency>
-            <dependency>
-                <groupId>com.fasterxml.jackson.core</groupId>
-                <artifactId>jackson-annotations</artifactId>
-                <version>${gs.jackson.version}</version>
+                <version>${commons.text.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-core</artifactId>
-                <version>${gs.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>${gs.jackson.databind.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.dataformat</groupId>
                 <artifactId>jackson-dataformat-xml</artifactId>
-                <version>${gs.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.datatype</groupId>
                 <artifactId>jackson-datatype-jsr310</artifactId>
-                <version>${gs.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
-                <groupId>com.google.errorprone</groupId>
-                <artifactId>error_prone_annotations</artifactId>
-                <version>${gs.error.prone.version}</version>
-                <scope>provided</scope>
-            </dependency>
-            <dependency>
-                <groupId>org.checkerframework</groupId>
-                <artifactId>checker-qual</artifactId>
-                <version>${gs.checker.qual.version}</version>
+                <groupId>com.fasterxml.jackson.core</groupId>
+                <artifactId>jackson-annotations</artifactId>
+                <version>${jackson.annotations.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
@@ -224,7 +204,7 @@
             <dependency>
                 <groupId>org.antlr</groupId>
                 <artifactId>antlr4-runtime</artifactId>
-                <version>${gs.antlr.version}</version>
+                <version>${antlr.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>

geomesa-archetypes/geomesa-archetypes-spark-runtime/pom.xml

@@ -38,19 +38,19 @@
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-core</artifactId>
-                <version>${fasterxml.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>${fasterxml.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-annotations</artifactId>
-                <version>${fasterxml.jackson.version}</version>
+                <version>${jackson.annotations.version}</version>
                 <scope>provided</scope>
             </dependency>
             <dependency>

pom.xml

@@ -106,9 +106,10 @@
 
         <!-- standardized transitive dependencies -->
         <aircompressor.version>0.27</aircompressor.version>
-        <fasterxml.jackson.version>2.19.0</fasterxml.jackson.version> <!-- used by geoserver, spark and arrow -->
         <h2.version>2.2.224</h2.version>
         <hsql.version>2.7.2</hsql.version>
+        <jackson.version>2.21.1</jackson.version> <!-- used by geoserver, spark and arrow -->
+        <jackson.annotations.version>2.21</jackson.annotations.version> <!-- note: in most places this is managed through the jackson bom -->
         <jetty.version>9.4.57.v20241219</jetty.version>
         <jna.version>5.14.0</jna.version>
         <json.smart.version>2.5.2</json.smart.version> <!-- used by json-path and hadoop-auth -->
@@ -129,7 +130,7 @@
         <!-- provided artifacts, not bundled to support multiple environments -->
         <accumulo.version>2.1.4</accumulo.version>
         <accumulo-20.version>2.0.1</accumulo-20.version>
-        <zookeeper.version>3.9.4</zookeeper.version>
+        <zookeeper.version>3.9.5</zookeeper.version>
         <thrift.version>0.17.0</thrift.version>
         <thrift-accumulo-20.version>0.12.0</thrift-accumulo-20.version>
         <thrift-cassandra.version>0.12.0</thrift-cassandra.version>
@@ -1683,14 +1684,14 @@
             <dependency>
                 <groupId>com.fasterxml.jackson</groupId>
                 <artifactId>jackson-bom</artifactId>
-                <version>${fasterxml.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.module</groupId>
                 <artifactId>jackson-module-scala_${scala.binary.version}</artifactId>
-                <version>${fasterxml.jackson.version}</version>
+                <version>${jackson.version}</version>
                 <scope>provided</scope> <!-- from spark -->
             </dependency>
             <dependency>