Fix blocking security scan findings on main

[sreekanth-db]

Summary

• upgrade Apache HttpClient to 5.6.3, which officially resolves both httpcore5 and httpcore5-h2 to patched version 5.4.3
• update Jackson, lz4-java, and shaded Netty dependencies to clear the remaining current OSV findings
• document the user-visible dependency updates in NEXT_CHANGELOG.md

Closes #1584.

Test plan

• mvn clean package -Dmaven.test.skip=true -Ddependency-check.skip=true -B
• Maven dependency tree resolves httpclient5:5.6.3, httpcore5:5.4.3, and httpcore5-h2:5.4.3
• verified the uber JAR embeds those versions plus Jackson 2.18.9, lz4-java 1.11.1, and Netty 4.2.15.Final
• GitHub Security Scan
• local PR integration tests
• external JDBC integration tests

Telemetry Errors

• Not applicable — this change does not add or change a telemetry-visible error.

[peco-review-bot]

Verdict: 1 Low

Clean, consistent security dependency bump — httpcore5 5.4.3 (+ new httpcore5-h2 pin), Jackson 2.18.9, lz4-java 1.11.1, Netty 4.2.15.Final — with matching NEXT_CHANGELOG entries. Version properties are consistent and the httpcore5-h2 pin correctly lives in the parent dependencyManagement that both jdbc-core and the uber assembly inherit. One low-severity note: verify httpclient5 5.5.2 runtime compatibility with the forced httpcore5 5.4.3, since the test plan skipped tests.

[peco-review-bot]

Verdict: 1 Medium

Dependency-bump PR to clear security-scan findings. One medium concern: the PR description claims to "pin httpcore5-h2," but no such pin exists in the diff or poms — it's only pulled transitively via httpclient5, so the CVE fix isn't enforced and it may skew from the explicitly-pinned httpcore5 5.4.3. The changelog entry and other version bumps look fine.

Other findings

• 🟡 Medium — The PR description says it will "pin httpcore5-h2" to clear the blocking CVSS 7.5 finding, but there is no such pin anywhere in the diff or the poms — httpcore5-h2 is declared neither as a direct dependency nor in <dependencyManagement> (grep finds it only in the historical CHANGELOG.md). Two consequences worth confirming before relying on this to close the finding:

1. The CVE fix for httpcore5-h2 is not guaranteed. httpcore5-h2 is pulled in only transitively via httpclient5 (async-httpclient.version = 5.6.3). Its resolved version is whatever that transitive edge declares — the explicit httpcore5 pin (5.4.3) governs a different artifact and does not constrain httpcore5-h2. If the security finding is against httpcore5-h2 specifically, it is only resolved if httpclient5 5.6.3 happens to bring a patched httpcore5-h2; it is not enforced here.

2. Potential version skew between httpcore5 and httpcore5-h2. These two artifacts are released in lockstep and share internal APIs, so they must resolve to the same version. Forcing httpcore5 to 5.4.3 while httpcore5-h2 floats transitively (potentially to whatever httpclient5 5.6.3 was built against) risks a mismatch that can surface as runtime linkage errors (NoSuchMethodError/NoClassDefFoundError) on the HTTP/2 path.

Recommend explicitly pinning httpcore5-h2 to ${httpcore5.version} (as a direct dependency or in <dependencyManagement>) to both enforce the CVE fix and keep it aligned with httpcore5. Please also confirm the resolved uber-JAR actually contains httpcore5-h2 5.4.3 (the test plan only mentions verifying httpcore5 and httpcore5-h2 5.4.3 — worth double-checking that claim given no pin exists).

[github-actions]

JDBC integration tests triggered (replay, thrift + sea). View workflow runs.

[sreekanth-db]

Addressing the latest reviewer-bot concern: httpcore5-h2 is intentionally no longer manually pinned. Apache HttpClient 5.6.3's published dependency management declares both httpcore5 and httpcore5-h2 at 5.4.3.

Verified in this branch:

• Maven dependency tree: httpclient5:5.6.3 → httpcore5-h2:5.4.3, with direct httpcore5:5.4.3
• built uber JAR contains httpclient5-5.6.3.jar, httpcore5-5.4.3.jar, and httpcore5-h2-5.4.3.jar
• Security Scan and local PR integration tests pass

Official dependency report: https://hc.apache.org/httpcomponents-client-5.6.x/5.6.3/httpclient5/dependencies.html