deps: Tier 1 of #72 is complete; derby 10.14.2.0 is unfixable on Java 1.8 (moved to Tier 3)

[natechadwick-intsof]

Summary

Closes out the Tier 1 portion of parent epic #72. After #79 landed (13 of the 19 GAVs in the original plan) and the post-#79 state was re-checked, all 19 GAVs from the original Tier 1 plan are either closed or have to be reclassified as Tier 3 (no Java 1.8 fix exists). The 7 derby CVEs are the only remaining open items from the Tier 1 plan.

Status of the original 19 GAVs

#	GAV	Original plan	Current state	Outcome
1	jackson-databind	2.21.5	2.21.5 (from #79)	✅ closed by #79
2	netty-handler	4.1.135.Final	4.1.136.Final via Netty BOM (from #79)	✅ closed by #79
3	zookeeper	3.7.2	3.7.2 (from #79)	✅ closed by #79
4	snakeyaml	1.32 or 2.0	2.6	✅ already at or past the plan fix
5	derby	10.14.2.1	10.14.2.0	❌ plan version does not exist on Maven Central; next version (10.15.x) is Java 9+ bytecode, not Java 1.8 compatible — see Reclassifying derby below
6	protobuf-java	3.25.5	4.33.2 (transitive from com.google.javascript:closure-compiler:rr2079.1)	✅ already at or past the plan fix
7	netty-codec	4.1.136.Final	4.1.136.Final via Netty BOM (from #79)	✅ closed by #79
8	jackson-core	2.21.4	2.21.5 (from #79, jackson.version covers it)	✅ closed by #79
9	junrar	7.5.10	7.5.10 (from #79)	✅ closed by #79
10	snappy-java	1.1.10.4	1.1.10.4 (from #79)	✅ closed by #79
11	jsoup	1.23.1	1.23.1	✅ already at the plan fix
12	httpclient5	5.6.3	5.6.3 (from #79)	✅ closed by #79
13	jetty-webapp	9.4.33.v20201020	9.4.58.v20250814 (via jetty.version)	✅ already past the plan fix
14	netty-common	4.1.118.Final	4.1.136.Final via Netty BOM (from #79)	✅ closed by #79
15	jakarta.mail	1.6.8	1.6.8 (from #79)	✅ closed by #79
16	netty-transport-native-epoll	4.1.135.Final	4.1.136.Final via Netty BOM (from #79)	✅ closed by #79
17	httpcore5	5.4.3	5.4.3 (from #79)	✅ closed by #79
18	httpcore5-h2	5.4.3	5.4.3 (from #79)	✅ closed by #79
19	poi-ooxml	5.4.0	5.4.0 (from #79)	✅ closed by #79

Closed: 18 of 19. Reclassified: 1 (derby, 7 CVEs).

Reclassifying derby

The original Tier 1 plan said org.apache.derby:derby 10.14.2.0 -> 10.14.2.1 (7 CVEs closed: 1 CRITICAL, 6 HIGH). That fix version does not exist on Maven Central. The actual next Derby release after 10.14.2.0 is 10.15.1.3, and it ships:

• module-info.class at the root of the jar (not under META-INF/versions/9/)
• Class major version 53 (Java 9 bytecode)
• No multi-release jar structure

That is plain Java 9 bytecode, not Java 1.8 compatible — a real Java 8 runtime will throw UnsupportedClassVersionError. Same for 10.15.2.0, 10.16.1.1 (Java 17), and 10.17.1.0 (Java 19). Derby 10.14.2.0 is the last Java 1.8 release.

The 7 derby CVEs are therefore unfixable on the main branch as long as it targets Java 1.8. They join the Tier 3 list ("at the latest Java 1.8 line; no Java 1.8 fix exists") tracked in the parent epic #72.

How the 4 GAVs that were 'deferred' but turned out to be already done

These were already at the plan's fix version (or newer) on main before PR #79 landed — likely from a separate dependency cleanup that wasn't tagged to #72. The re-check after #79 is what surfaced this:

• snakeyaml had been bumped to 2.6 (newer than the plan's 1.32/2.0).
• jsoup had been bumped to 1.23.1 (the exact plan fix).
• jetty-webapp was already on ${jetty.version} = 9.4.58.v20250814 (newer than the plan's 9.4.33).
• netty-transport-native-epoll is covered by the new io.netty:netty-bom import in chore(deps): tier1 dependency upgrades for Java 1.8 (issue #72, 13 of 19 GAVs) #79 (4.1.136.Final, newer than the plan's 4.1.135).
• protobuf-java is transitive from com.google.javascript:closure-compiler:rr2079.1 which ships it at 4.33.2 (newer than the plan's 3.25.5).

Out of scope

• Migration of derby to a newer line would require moving the whole project to Java 9+ (or replacing Derby with H2/PostgreSQL embedded). Both are major workstreams, not version bumps.
• The Tier 2 hardening work (T2.1 Tika hardening, T2.6 commons-compress validation, T2.11 SnakeYAML SafeConstructor, T2.13 Jetty hardening, etc.) is tracked under the parent epic [deps] Tier 1: drop-in Java 1.8 version bumps for 19 vulnerable GAVs (closes 153 CVEs) #72 and has its own per-item issues.
• The remaining ~100 Tier 3 GAVs (and the ~7 derby CVEs now moved into Tier 3) are tracked under the parent epic.

References

• Parent epic: [deps] Tier 1: drop-in Java 1.8 version bumps for 19 vulnerable GAVs (closes 153 CVEs) #72
• Tier 1 PR: chore(deps): tier1 dependency upgrades for Java 1.8 (issue #72, 13 of 19 GAVs) #79 (13 of 19 GAVs addressed; 6 deferred; 5 of those 6 turn out to be already done)
• Full scan report: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md
• Tier 1 original plan: `docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/01-tier1-java8-upgrades.md"
  • Note: this file still lists 6 GAVs in the deferred section; closing this issue should also update that file to reflect the new status.
• Apache Derby release history: https://db.apache.org/derby/derby_downloads.html (10.14.2.0 is the final 10.14.x; the 10.15 line is Java 9+)

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.