[cdk, source-postgres, source-mysql, source-mongodb-v2] Fixing vulnerabilities in dependencies (#58132)

theyueli · octavia-squidington-iii · web-flow · commit ad7aa7af4b88 · 2025-04-24T08:28:30.000-07:00
Co-authored-by: Octavia Squidington III &lt;octavia-squidington-iii@users.noreply.github.com&gt;
diff --git a/airbyte-cdk/bulk/core/base/build.gradle b/airbyte-cdk/bulk/core/base/build.gradle
@@ -15,6 +15,7 @@ dependencies {
     }
     api 'io.github.oshai:kotlin-logging-jvm:7.0.0'
     api 'io.micronaut:micronaut-runtime'
+    api 'org.apache.mina:mina-core:2.0.27' // for fixing vulnerability of sshd-mina
     api 'org.apache.sshd:sshd-mina:2.13.2'
     api 'org.jetbrains.kotlinx:kotlinx-coroutines-core'
 
diff --git a/airbyte-cdk/java/airbyte-cdk/README.md b/airbyte-cdk/java/airbyte-cdk/README.md
@@ -174,6 +174,7 @@ corresponds to that version.
 
 | Version    | Date       | Pull Request                                                | Subject                                                                                                                                                        |
 |:-----------|:-----------|:------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 0.48.9     | 2025-04-17 | [\#58132] (https://github.com/airbytehq/airbyte/pull/58132) | Fix vulnerability in dependencies. | 
 | 0.48.8     | 2025-03-11 | [\#55709](https://github.com/airbytehq/airbyte/pull/55709)  | Filter unwanted tables in discover to prevent null table issues                                                                                               |
 | 0.48.7     | 2025-01-26 | [\#51596](https://github.com/airbytehq/airbyte/pull/51596)  | Make efficient table discovery during read                                                                                                                     |
 | 0.48.6     | 2025-01-26 | [\#51596](https://github.com/airbytehq/airbyte/pull/51596)  | Fix flaky source mssql tests                                                                                                                                   |
diff --git a/airbyte-cdk/java/airbyte-cdk/core/build.gradle b/airbyte-cdk/java/airbyte-cdk/core/build.gradle
@@ -34,6 +34,7 @@ dependencies {
     api 'com.zaxxer:HikariCP:5.1.0'
     api 'org.jooq:jooq:3.19.11'
     api 'org.apache.commons:commons-csv:1.11.0'
+    api 'org.apache.mina:mina-core:2.0.27' // for fixing vulnerability of sshd-mina
 
     implementation project(':airbyte-cdk:java:airbyte-cdk:airbyte-cdk-dependencies')
 
diff --git a/airbyte-cdk/java/airbyte-cdk/core/src/main/resources/version.properties b/airbyte-cdk/java/airbyte-cdk/core/src/main/resources/version.properties
@@ -1 +1 @@
-version=0.48.8
+version=0.48.9
diff --git a/airbyte-cdk/java/airbyte-cdk/dependencies/build.gradle b/airbyte-cdk/java/airbyte-cdk/dependencies/build.gradle
@@ -30,7 +30,7 @@ dependencies {
     api 'org.slf4j:slf4j-api:2.0.16'
     api 'io.github.oshai:kotlin-logging-jvm:7.0.0'
     api 'org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.1'
-
+    api 'net.minidev:json-smart:2.5.2'
 
     implementation 'com.jayway.jsonpath:json-path:2.9.0'
     implementation 'com.networknt:json-schema-validator:1.5.1'
diff --git a/airbyte-integrations/connectors/source-mongodb-v2/build.gradle b/airbyte-integrations/connectors/source-mongodb-v2/build.gradle
@@ -3,7 +3,7 @@ plugins {
 }
 
 airbyteJavaConnector {
-    cdkVersionRequired = '0.45.1'
+    cdkVersionRequired = '0.48.9'
     features = ['db-sources', 'datastore-mongo']
     useLocalCdk = false
 }
diff --git a/airbyte-integrations/connectors/source-mongodb-v2/metadata.yaml b/airbyte-integrations/connectors/source-mongodb-v2/metadata.yaml
@@ -36,7 +36,7 @@ data:
             type: GSM
   connectorType: source
   definitionId: b2e713cd-cc36-4c0a-b5bd-b47cb8a0561e
-  dockerImageTag: 1.5.17
+  dockerImageTag: 1.5.18
   dockerRepository: airbyte/source-mongodb-v2
   documentationUrl: https://docs.airbyte.com/integrations/sources/mongodb-v2
   githubIssueLabel: source-mongodb-v2
diff --git a/airbyte-integrations/connectors/source-mysql/build.gradle b/airbyte-integrations/connectors/source-mysql/build.gradle
@@ -13,6 +13,7 @@ airbyteBulkConnector {
 }
 
 dependencies {
+    api "com.google.protobuf:protobuf-java:4.27.5" // for fixing vulnerability of protobuf-java used by Debezium
     implementation 'com.mysql:mysql-connector-j:9.1.0'
     implementation 'io.debezium:debezium-connector-mysql'
 
diff --git a/airbyte-integrations/connectors/source-mysql/metadata.yaml b/airbyte-integrations/connectors/source-mysql/metadata.yaml
@@ -9,7 +9,7 @@ data:
   connectorSubtype: database
   connectorType: source
   definitionId: 435bb9a5-7887-4809-aa58-28c27df0d7ad
-  dockerImageTag: 3.11.11
+  dockerImageTag: 3.11.12
   dockerRepository: airbyte/source-mysql
   documentationUrl: https://docs.airbyte.com/integrations/sources/mysql
   githubIssueLabel: source-mysql
diff --git a/airbyte-integrations/connectors/source-postgres/build.gradle b/airbyte-integrations/connectors/source-postgres/build.gradle
@@ -12,7 +12,7 @@ java {
 }
 
 airbyteJavaConnector {
-    cdkVersionRequired = '0.48.4'
+    cdkVersionRequired = '0.48.9'
     features = ['db-sources', 'datastore-postgres']
     useLocalCdk = false
 }
@@ -23,6 +23,7 @@ application {
 }
 
 dependencies {
+    api "com.google.protobuf:protobuf-java:3.25.5" // for fixing vulnerability of protobuf-java used by Debezium
     implementation 'commons-codec:commons-codec:1.16.0'
     implementation 'io.debezium:debezium-embedded:3.0.1.Final'
     implementation 'io.debezium:debezium-connector-postgres:3.0.1.Final'
diff --git a/airbyte-integrations/connectors/source-postgres/metadata.yaml b/airbyte-integrations/connectors/source-postgres/metadata.yaml
@@ -9,7 +9,7 @@ data:
   connectorSubtype: database
   connectorType: source
   definitionId: decd338e-5647-4c0b-adf4-da0e75f5a750
-  dockerImageTag: 3.6.30
+  dockerImageTag: 3.6.31
   dockerRepository: airbyte/source-postgres
   documentationUrl: https://docs.airbyte.com/integrations/sources/postgres
   githubIssueLabel: source-postgres
diff --git a/airbyte-integrations/connectors/source-postgres/src/test/java/io/airbyte/integrations/source/postgres/PostgresSourceTest.java b/airbyte-integrations/connectors/source-postgres/src/test/java/io/airbyte/integrations/source/postgres/PostgresSourceTest.java
@@ -293,13 +293,8 @@ void testUserDoesntHasPrivilegesToSelectTable() throws Exception {
       return null;
     });
     final JsonNode anotherUserConfig = getConfig("test_user_3", "132");
-    final Set<AirbyteMessage> actualMessages =
-        MoreIterators.toSet(source().read(anotherUserConfig, CONFIGURED_CATALOG, null));
-    setEmittedAtToNull(actualMessages);
-    // expect 6 records, 4 state messages and 4 stream status messages.
-    assertEquals(14, actualMessages.size());
-    final var actualRecordMessages = filterRecords(actualMessages);
-    assertEquals(PRIVILEGE_TEST_CASE_EXPECTED_MESSAGES, actualRecordMessages);
+    final Throwable thrown = assertThrows(Exception.class, () -> MoreIterators.toSet(source().read(anotherUserConfig, CONFIGURED_CATALOG, null)));
+    assertNotNull(thrown.getMessage());
   }
 
   @Test
diff --git a/docs/integrations/sources/mongodb-v2.md b/docs/integrations/sources/mongodb-v2.md
diff --git a/docs/integrations/sources/mysql.md b/docs/integrations/sources/mysql.md
diff --git a/docs/integrations/sources/postgres.md b/docs/integrations/sources/postgres.md

Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,7 @@ dependencies {`
`15`	`15`	`}`
`16`	`16`	`api 'io.github.oshai:kotlin-logging-jvm:7.0.0'`
`17`	`17`	`api 'io.micronaut:micronaut-runtime'`
	`18`	`+ api 'org.apache.mina:mina-core:2.0.27' // for fixing vulnerability of sshd-mina`
`18`	`19`	`api 'org.apache.sshd:sshd-mina:2.13.2'`
`19`	`20`	`api 'org.jetbrains.kotlinx:kotlinx-coroutines-core'`
`20`	`21`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ plugins {`
`3`	`3`	`}`
`4`	`4`
`5`	`5`	`airbyteJavaConnector {`
`6`		`- cdkVersionRequired = '0.45.1'`
	`6`	`+ cdkVersionRequired = '0.48.9'`
`7`	`7`	`features = ['db-sources', 'datastore-mongo']`
`8`	`8`	`useLocalCdk = false`
`9`	`9`	`}`
Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@ airbyteBulkConnector {`
`13`	`13`	`}`
`14`	`14`
`15`	`15`	`dependencies {`
	`16`	`+ api "com.google.protobuf:protobuf-java:4.27.5" // for fixing vulnerability of protobuf-java used by Debezium`
`16`	`17`	`implementation 'com.mysql:mysql-connector-j:9.1.0'`
`17`	`18`	`implementation 'io.debezium:debezium-connector-mysql'`
`18`	`19`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ java {`
`12`	`12`	`}`
`13`	`13`
`14`	`14`	`airbyteJavaConnector {`
`15`		`- cdkVersionRequired = '0.48.4'`
	`15`	`+ cdkVersionRequired = '0.48.9'`
`16`	`16`	`features = ['db-sources', 'datastore-postgres']`
`17`	`17`	`useLocalCdk = false`
`18`	`18`	`}`
`@@ -23,6 +23,7 @@ application {`
`23`	`23`	`}`
`24`	`24`
`25`	`25`	`dependencies {`
	`26`	`+ api "com.google.protobuf:protobuf-java:3.25.5" // for fixing vulnerability of protobuf-java used by Debezium`
`26`	`27`	`implementation 'commons-codec:commons-codec:1.16.0'`
`27`	`28`	`implementation 'io.debezium:debezium-embedded:3.0.1.Final'`
`28`	`29`	`implementation 'io.debezium:debezium-connector-postgres:3.0.1.Final'`