[PR] [fix][sec] Upgrade jline to 4.2.1 and picocli to 4.7.7, drop unused jline2 [pulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari opened a new pull request, #26068:
URL: https://github.com/apache/pulsar/pull/26068

   ### Motivation
   
   The Pulsar CLI/shell tooling bundles JLine and picocli, managed through the Gradle
   version catalog (`gradle/libs.versions.toml`). Two things motivate this change:
   
   1. **Security.** Pulsar packages `org.jline:jline` 3.21.0. This is the JLine aggregate
      ("uber") artifact that bundles every JLine module, including `jline-remote-telnet`
      (the `org/jline/builtins/telnet/...` classes are present in the jar). That module is
      affected by two HIGH-severity (CVSS 7.5) advisories in versions `< 4.2.1`, both fixed
      in **4.2.1**:
      - [GHSA-47qp-hqvx-6r3f](https://github.com/advisories/GHSA-47qp-hqvx-6r3f) — *JLine3
        Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet
        NEW-ENVIRON Variables*
      - [GHSA-2r2c-cx56-8933](https://github.com/advisories/GHSA-2r2c-cx56-8933) — *JLine3
        Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry*
   
      So the 3.21.0 bundle Pulsar ships contains the vulnerable telnet classes. Pulsar does
      not start a JLine telnet server (the shell only uses JLine for line editing/completion),
      so the code is not reachable through Pulsar's own usage, but the vulnerable classes are
      still packaged in the distribution and get flagged by dependency/security scanners.
      Upgrading `jline` to 4.2.1 incorporates the fixes.
   
   2. **Maintenance / cleanup.** `picocli` (4.7.5) and `jline` (3.21.0) were behind their
      latest upstream releases, and the legacy `jline2` (`jline:jline` 2.14.6) dependency is
      no longer a build dependency of any module — it was only declared in the server
      distribution packaging. Keeping unused and outdated dependencies increases the
      maintenance and licensing surface for no benefit.
   
   ### Modifications
   
   - Upgrade `jline` (`org.jline:jline`) from 3.21.0 to 4.2.1 (latest), which fixes
     GHSA-47qp-hqvx-6r3f and GHSA-2r2c-cx56-8933.
   - Upgrade `picocli` from 4.7.5 to 4.7.7 (latest); `picocli-shell-jline3` follows the same
     version reference.
   - Remove the unused `jline2` (`jline:jline` 2.14.6) dependency from the version catalog
     and from the server distribution packaging (`distribution/server/build.gradle.kts`).
   - Remove the now-dead `jline2` shade `include`/`relocate` entries (for the `jline:` Maven
     group / `jline.*` packages) from `pulsar-functions/localrun-shaded`. These were specific
     to JLine 2; the local-runner shaded classpath does not contain any JLine artifact
     (verified via `runtimeClasspath`), so the shaded jar contents are unchanged.
   - Update the bundled `LICENSE.bin.txt` for the server and shell distributions to reflect
     the new jar versions and the removal of the JLine 2 jar.
   
   ### Verifying this change
   
   This change is a dependency upgrade / cleanup without new test coverage. It is covered by
   the existing build and distribution binary-license check, and by
   `org.apache.pulsar.shell.PulsarShellTest`, which exercises the Pulsar shell against the
   upgraded JLine. Locally verified to pass: `spotlessCheck`, `checkstyleMain`,
   `checkstyleTest`, `:pulsar-client-tools` main + test compilation, and `PulsarShellTest`
   (the only module using JLine directly) against jline 4.2.1.
   
   ### Does this pull request potentially affect one of the following parts:
   
   *If the box was checked, please highlight the changes*
   
   - [x] Dependencies (add or upgrade a dependency)
   - [ ] The public API
   - [ ] The schema
   - [ ] The default values of configurations
   - [ ] The threading model
   - [ ] The binary protocol
   - [ ] The REST endpoints
   - [ ] The admin CLI options
   - [ ] The metrics
   - [ ] Anything that affects deployment
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [fix][sec] Upgrade jline to 4.2.1 and picocli to 4.7.7, drop unused jline2 [pulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari merged PR #26068:
URL: https://github.com/apache/pulsar/pull/26068


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org