fix(deps): Upgrade vulnerable dependencies to resolve CVEs (#953)

* fix(deps): Upgrade vulnerable dependencies to resolve CVEs

Upgrade Bouncy Castle bcprov-jdk15to18 1.78.1 -> 1.84 and
bcpkix-jdk18on 1.79 -> 1.84 to fix CVE-2026-5598, CVE-2026-0636,
and CVE-2026-5588.

Upgrade plexus-utils force from 3.3.0 -> 4.0.2 to fix CVE-2025-67030.

Update license SHA1 files for Bouncy Castle, Netty 4.1.131 -> 4.1.135,
and Jackson 2.18.2 -> 2.18.6 (aligned with OpenSearch core 2.19.6).

Signed-off-by: Ajay Raj Nelapudi <ajnelapu@amazon.com>

* ci: Pin all GitHub Actions to full-length commit SHAs

Pin actions to immutable commit SHAs to comply with opensearch-project
org security policy. Also upgrade actions/setup-java v1 -> v4 and
actions/checkout v2 -> v4 in gradle.yml.

Signed-off-by: Ajay Raj Nelapudi <ajnelapu@amazon.com>

* ci: Add dead opendistro PR link to lycheeignore

The opendistro-for-elasticsearch repo was migrated and PR #389 no
longer exists, causing lychee link checker to fail.

Signed-off-by: Ajay Raj Nelapudi <ajnelapu@amazon.com>

---------

Signed-off-by: Ajay Raj Nelapudi <ajnelapu@amazon.com>
Co-authored-by: Ajay Raj Nelapudi <ajnelapu@amazon.com>

Author: AjayRajNelapudi

.github/workflows/add-untriaged.yml

@@ -8,7 +8,7 @@ jobs:
   apply-label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325 # v6
         with:
           script: |
             github.rest.issues.addLabels({

.github/workflows/backport.yml

@@ -15,14 +15,14 @@ jobs:
     steps:
       - name: GitHub App token
         id: github_app_token
-        uses: tibdex/github-app-token@v1.5.0
+        uses: tibdex/github-app-token@918e03f91c95714f3d75f0140b3a5c5f738300df # v1.5.0
         with:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
           installation_id: 22958780
 
       - name: Backport
-        uses: VachaShah/backport@v1.1.4
+        uses: VachaShah/backport@c2be57a934c3c4bb88508ca4a9023f3ce85339dc # v1.1.4
         with:
           github_token: ${{ steps.github_app_token.outputs.token }}
-          branch_name: backport/backport-${{ github.event.number }}
+          branch_name: backport/backport-${{ github.event.number }}

.github/workflows/cd.yml

@@ -11,12 +11,13 @@ jobs:
 
     steps:
       - name: Checkout Performance Analyzer package
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           path: ./tmp/pa
       - name: Set up JDK 1.12
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
+          distribution: temurin
           java-version: 1.12
       - name: Build Artifacts
         working-directory: ./tmp/pa
@@ -31,7 +32,7 @@ jobs:
           cp $deb_artifact artifacts/
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@6a64f289c4a4b67a1e2c44cc4bd9d6f7bc59b156 # v1
         with:
           aws-access-key-id: ${{ secrets.AWS_STAGING_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_STAGING_SECRET_ACCESS_KEY }}
@@ -62,7 +63,7 @@ jobs:
           aws s3 cp --quiet $deb ${s3_prefix}${deb_outfile}
 
       - name: Upload Workflow Artifacts
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@34622df80861c3ed63eb2bff892de2f1fbf4c9da # v1
         with:
           name: artifacts
           path: ./tmp/pa/artifacts/

.github/workflows/create-documentation-issue.yml

@@ -14,22 +14,22 @@ jobs:
     steps:
       - name: GitHub App token
         id: github_app_token
-        uses: tibdex/github-app-token@v1.5.0
+        uses: tibdex/github-app-token@918e03f91c95714f3d75f0140b3a5c5f738300df # v1.5.0
         with:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
           installation_id: 22958780
 
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
       - name: Edit the issue template
         run: |
           echo "https://github.com/opensearch-project/performance-analyzer/pull/${{ env.PR_NUMBER }}." >> ./.github/ISSUE_TEMPLATE/documentation-issue.md
           
       - name: Create Issue From File
         id: create-issue
-        uses: peter-evans/create-issue-from-file@v4
+        uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f # v4
         with:
           title: Add documentation related to new feature
           content-filepath: ./.github/ISSUE_TEMPLATE/documentation-issue.md

.github/workflows/delete_backport_branch.yml

@@ -10,6 +10,6 @@ jobs:
     if: startsWith(github.event.pull_request.head.ref,'backport/')
     steps:
       - name: Delete merged branch
-        uses: SvanBoxel/delete-merged-branch@main
+        uses: SvanBoxel/delete-merged-branch@2b5b058e3db41a3328fd9a6a58fd4c2545a14353 # main
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/gradle.yml

@@ -19,12 +19,13 @@ jobs:
     name: Building PA package
     steps:
     - name: Set up JDK
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
+        distribution: temurin
         java-version: ${{matrix.java}}
     # Performance Analyzer in ./tmp/performance-analyzer
     - name: Checkout Performance Analyzer package
-      uses: actions/checkout@v2
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         path: ./tmp/performance-analyzer
       # Explicitly set the docker-compose program path so that our build scripts in RCA can run the program

.github/workflows/links.yml

@@ -6,9 +6,9 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Lychee Link Checker
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
         with:
           args: --accept=200,403,429 --exclude-file .lycheeignore **/*.html **/*.md **/*.txt **/*.json
           fail: true

.github/workflows/maven-publish.yml

@@ -16,14 +16,14 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
-          distribution: temurin # Temurin is a distribution of adoptium
+          distribution: temurin
           java-version: 21
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Load secret
-        uses: 1password/load-secrets-action@v2
+        uses: 1password/load-secrets-action@2ebe1bc766ed99dcfc292ae0308a9492144563c8 # v2
         with:
           # Export loaded secrets as environment variables
           export-env: true
@@ -33,7 +33,7 @@ jobs:
           MAVEN_SNAPSHOTS_S3_ROLE: op://opensearch-infra-secrets/maven-snapshots-s3/role
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@cabfdba3510de1431bac9dba27511d97497fc100 # v5
         with:
           role-to-assume: ${{ env.MAVEN_SNAPSHOTS_S3_ROLE }}
           aws-region: us-east-1

.lycheeignore

@@ -6,3 +6,6 @@ http://www.junit.org/license
 https://junit.org/license
 
 # Add other problematic URLs here as needed
+
+# Opendistro repo was migrated to opensearch-project; old PR links are dead
+https://github.com/opendistro-for-elasticsearch/performance-analyzer/pull/389

build.gradle

@@ -296,7 +296,7 @@ dependencies {
             force "org.apache.commons:commons-lang3:${versions.commonslang}"
             force "org.slf4j:slf4j-api:2.0.0"
             force "com.google.guava:guava:${guavaVersion}"
-            force "org.codehaus.plexus:plexus-utils:3.3.0"
+            force "org.codehaus.plexus:plexus-utils:4.0.2"
             force "org.apache.httpcomponents:httpcore:${versions.httpcore}"
             force "commons-codec:commons-codec:${versions.commonscodec}"
             force "io.netty:netty-codec-http2:${nettyVersion}"
@@ -308,8 +308,8 @@ dependencies {
 
     implementation 'org.jooq:jooq:3.10.8'
     implementation "org.apache.commons:commons-lang3:${versions.commonslang}"
-    implementation 'org.bouncycastle:bcprov-jdk15to18:1.78.1'
-    implementation 'org.bouncycastle:bcpkix-jdk18on:1.79'
+    implementation 'org.bouncycastle:bcprov-jdk15to18:1.84'
+    implementation 'org.bouncycastle:bcpkix-jdk18on:1.84'
     implementation "org.opensearch:performance-analyzer-commons:${paCommonsVersion}"
     implementation "com.fasterxml.jackson.core:jackson-annotations:${jacksonVersion}"
     implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonDataBindVersion}"