Bump shaded jackson, httpcore5-h2, netty, commons-configuration2, lz4 to address CVEs

[vikrantpuppala]

Summary

Bumps five shaded/published dependencies that consumers can't override via Maven dependency management — either because they're shaded into the uber JAR, or (for the lz4 case) because they're declared as flattened transitives in the published databricks-jdbc-thin POM.

Dependency	From	To	Reason
jackson-core	2.18.6	2.18.7	SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 — DoS via oversized JSON documents bypassing size limits
httpclient5 / httpcore5 / httpcore5-h2	5.3.1	5.5.2 / 5.3.6	CVE-2025-8671 — HTTP/2 stream-reset DoS in httpcore5-h2
netty-buffer / netty-common	4.2.12.Final	4.2.13.Final	Clears the May 2026 netty codec CVE batch: CVE-2026-33870, CVE-2026-33871, CVE-2026-42585, CVE-2026-42587, and others. All advisories target netty's HTTP/codec components, which the driver does not use (netty is only used as Arrow's off-heap buffer allocator) — but the bump silences the scanner false-positive CPE matches against netty-buffer/netty-common.
commons-configuration2	2.10.1	2.15.0	CVE-2026-45205 — uncontrolled recursion when parsing untrusted YAML configs (the driver does not parse untrusted YAML; practical risk is negligible)
lz4-java	org.lz4:lz4-java:1.8.1	at.yawk.lz4:lz4-java:1.10.1	CVE-2025-66566 — information leak via uncleared output buffers in safe/unsafe Java decompressors

Also extracts a separate httpcore5.version property because httpclient5 5.5.2 and httpcore5 are no longer published in lockstep on the 5.5 line (httpclient5 5.5.2 transitively pulls httpcore5 5.3.6).

Fixes #1436. Fixes #1455. Fixes #1457. (Issue #1423 — netty in 3.3.1 — was already fixed by the netty 4.2.6 → 4.2.12 bump in #1347, shipped in 3.3.2. This PR additionally moves to 4.2.13.Final.)

Notes on the lz4 bump

org.lz4:lz4-java:1.8.1 is a relocation-only POM that resolves to at.yawk.lz4:lz4-java:1.8.1 (the upstream org.lz4 GA is no longer maintained). Maven's relocation handling meant the published databricks-jdbc-thin POM declared at.yawk.lz4:lz4-java:1.8.1 as a flat transitive — and the uber JAR shaded that same vulnerable jar. Bumping the groupId to at.yawk.lz4 and the version to 1.10.1 (which has the fix for CVE-2025-66566) addresses both the thin and uber artifacts.

Practical risk for this driver is low — DecompressionUtil decompresses trusted server-sent Arrow chunks into freshly-allocated streams, not reused buffers — but the published artifacts should not carry the vulnerable version.

Note on #1457's Arrow CVE-2024-52338

The Arrow finding in #1457 (CVE-2024-52338) is a CPE false positive and does not require an Arrow bump. The Apache advisory explicitly states it covers only the Apache Arrow R package on CRAN (R 4.0.0 – 16.1.0, fixed in R 17.0.0). The driver ships Java Arrow 18.3.0, which is unaffected by both ecosystem (Java ≠ R) and version range. This will be silenced via an owasp-suppressions.xml entry in a separate follow-up PR (same precedent as the existing CVE-2026-25087 suppression for Arrow C++ vs Java).

Out of scope — follow-up

• libthrift 0.19.0 → 0.23.0: required to clear the May 2026 libthrift CVE batch from scanner reports (most of those CVEs target Go/Node/C_glib/Rust bindings and don't affect Java usage, but scanners match by GA coordinates). Bump cannot be done in this PR because libthrift 0.21 changed the ProcessFunction generic signature, and the checked-in Thrift-generated Java code at src/main/java/com/databricks/jdbc/model/client/thrift/generated/TCLIService.java needs to be regenerated with the 0.23 compiler from src/main/java/com/databricks/jdbc/dbclient/impl/thrift/TCLIService.thrift. There is currently no codegen script or Maven plugin in the repo to do this — should be tracked separately and probably wired up as a regenerate-thrift.sh so it isn't lost in the future.
• protobuf-java 3.25.5 CVE-2026-0994: Python-only (google.protobuf.json_format.ParseDict()); no Java fix exists and no action needed.
• grpc-api 1.71.0 CVE-2026-33186: Go-only (gRPC-Go server authz bypass); grpc-java is unaffected. Follow-up suppression PR will silence this scanner false positive.
• OWASP scanner gap (CVE-2025-66566 in lz4 missed our weekly scan): dependency-check identifies at.yawk.lz4:lz4-java@1.8.1 correctly but matches zero vulnerabilities against it because the at.yawk.lz4 GA has no CPE in NVD. The OSS Index analyzer is configured in jdbc-core/pom.xml but no credentials are wired in vulnerabilityCatcher.yml, so it's effectively never enriching results. Recommend (a) wiring OSS Index creds or (b) adding a purl-based scanner (osv-scanner / dependency-track) to the weekly workflow as a backstop.

Test plan

• mvn clean install -DskipTests -Plocal succeeds.
• mvn -pl jdbc-core test -Plocal -Dgroups='!Jvm17PlusAndArrowToNioReflectionDisabled' — 3288 tests, 0 failures, 0 errors.
• mvn -pl jdbc-core test -Plocal -Dtest='DecompressionUtilTest' — passes (lz4 decompression).
• Verified the shaded uber JAR contains the expected versions via unzip -p META-INF/maven/*/<artifact>/pom.properties:
  • jackson-core 2.18.7, jackson-databind 2.18.7
  • httpclient5 5.5.2, httpcore5 5.3.6, httpcore5-h2 5.3.6
  • netty-buffer 4.2.13.Final, netty-common 4.2.13.Final
  • commons-configuration2 2.15.0
  • at.yawk.lz4:lz4-java 1.10.1
• Verified assembly-thin/dependency-reduced-pom.xml now declares at.yawk.lz4:lz4-java:1.10.1 (was at.yawk.lz4:lz4-java:1.8.1).
• Full PR CI: unit tests on all JDK matrix entries, integration tests, integration smoke against DBSQL.

This pull request and its description were written by Isaac.