[wu-sheng]

Bump dependencies to fix security alerts

This PR only touches dependencies that are not provided scope: test-scope dependencies and the plugin test tooling. It also moves GitHub Actions to the versions the ASF currently approves.

Dependencies

Package	Old -> New	Manifest	Scope	Alerts
junit:junit	4.12 -> 4.13.2	pom.xml	test (dependencyManagement)	GHSA-269g-pwp5-87pp / CVE-2020-15250
org.apache.logging.log4j:log4j-core (and log4j-api to match)	2.8.1 -> 2.25.5	test/plugin/pom.xml	compile, plugin-test tooling only	GHSA-jfh8-c2jp-5v3q / CVE-2021-44228, GHSA-7rjr-3q55-vv33 / CVE-2021-45046, GHSA-p6xc-xr62-6r2g / CVE-2021-45105, GHSA-8489-44mv-ggj8 / CVE-2021-44832, GHSA-fxph-q3j8-mv87 / CVE-2017-5645, GHSA-vwqq-5vrc-xw9h / CVE-2020-9488, GHSA-vc5p-v9hr-52mj / CVE-2025-68161, GHSA-3pxv-7cmr-fjr4 / CVE-2026-34480, GHSA-h383-gmxw-35v2 / CVE-2026-34479
mysql:mysql-connector-java	8.0.13 -> 8.0.33	apm-sniffer/apm-sdk-plugin/mysql-common/pom.xml	test	GHSA-jcq3-cprp-m333 / CVE-2019-2692, GHSA-g76j-4cxx-23h9 / CVE-2022-21363, GHSA-w6f2-8wx4-47r5 / CVE-2021-2471

Notes:

• apm-test-tools, httpClient-4.x-plugin, httpclient-5.x-plugin, websphere-liberty-23.x-plugin and solon-2.x-plugin set their own junit.version=4.12, so they keep 4.12. Dependabot has no alerts on those manifests, and apm-test-tools declares junit as provided.
• mysql:mysql-connector-java:8.0.33 is a relocation POM to com.mysql:mysql-connector-j:8.0.33. GHSA-m6vm-37g8-gqvh / CVE-2023-22102 (<= 8.0.33) stays open, because no release under the old coordinates fixes it. The mysql-common tests do not import any MySQL driver class.
• CLAUDE.md is updated to say JUnit 4.13.2.

GitHub Actions

actions/*, github/* and apache/* are allowed by the ASF policy, so they keep the repo's tag style. Third-party actions are pinned by SHA from apache/infrastructure-actions actions.yml.

• actions/checkout v2 -> v7
• actions/setup-java v2 -> v6
• actions/upload-artifact v4 -> v7
• actions/download-artifact v4 -> v8. Every download is by name, so the v5 download-by-ID path change does not apply.
• actions/cache v4 -> v6
• github/codeql-action/init and analyze v3 -> v4
• docker/login-action dbcb8138… (v4.6.0, deprecated in the ASF list, expires 2027-01-16) -> 81c6f93d4bc991e510b342a00b419b3bb4efc5c6 (v4.7.0)
• apache/skywalking-eyes 9bd5feb8… (ci.yaml) and a63f4afc… (.github/actions/build), both commits from 2021 -> a196742f472feaffafea537ce5a2a4c3c53a8de4 (v0.9.0). v0.9.0 no longer treats the licenses ignore entry as matching dist-material/licenses/LICENSE-asm.txt, so .licenserc.yaml now also ignores dist-material/licenses.
• Unchanged, already current: docker/setup-qemu-action v4.4.0, docker/setup-buildx-action v4.4.1, apache/skywalking-infra-e2e 56ac8befeb5f910f2dc9339e65d07cd18953f90e.

E2E on Docker 29 / ubuntu-26.04: infra-e2e is already pinned to 56ac8bef…. The plugin-test run action already turns off the containerd image store. No workflow calls the docker-compose v1 binary, and no workflow pins a removed runner image. E2E on main is green, and this PR's CI covers it.

Verified locally

• JAVA_HOME=<jdk8> ./mvnw -B -f test/plugin/pom.xml -Dmaven.test.skip -pl runner-helper,agent-test-tools -am clean package: BUILD SUCCESS, with log4j 2.25.5 shaded into plugin-runner-helper.jar. I then ran that jar against mysql-scenario and it generated scenario.sh and docker-compose.yml. The containers module builds Docker images and was not run.
• JAVA_HOME=<jdk17> ./mvnw -B -Dmaven.gitcommitid.skip=true -pl apm-commons/apm-util,apm-commons/apm-datacarrier,apm-sniffer/apm-agent-core,apm-sniffer/apm-sdk-plugin/mysql-common -am clean verify: BUILD SUCCESS, all tests pass on JUnit 4.13.2, and checkstyle passes. The git-commit-id skip is needed only because the local checkout is a git worktree.
• dependency:list: junit resolves to 4.13.2 (test) in the modules that inherit it, and to 4.12 (provided) in apm-test-tools. mysql-common resolves com.mysql:mysql-connector-j:8.0.33 (test).
• license-eye header check built from skywalking-eyes v0.9.0 passes with the updated .licenserc.yaml: 0 invalid files.

Deliberately left unchanged

• Every <scope>provided</scope> plugin and toolkit dependency, for example struts2, dubbo, spring-webflux, log4j 1.x/2.x toolkit, kafka, mysql 5.x/6.x/8.x plugins and okhttp. These are compile-only compatibility targets, so their alerts are false positives.
• apm-toolkit-micrometer-registry / apm-toolkit-micrometer-1.10 micrometer-core (GHSA-g3pr-3p32-fp23): this is compile scope, but it is the API baseline the toolkit builds against. The vulnerable lines (<= 1.9.17, 1.10.0-1.13.15) have no patched release, and the CVE is in micrometer's HTTP server instrumentations, which the toolkit does not use.
• motan-plugin spring-context 4.2.4.RELEASE (test scope): the only fix on the 5.x line is 5.2.21 (a new major), and two of the three alerts have no fix before Spring 6, which needs Java 17.
• jdbc-commons mysql-connector-java [2.0.14,6.0.6] (test scope): this is a deliberate range, and the tests use com.mysql.cj.api.jdbc.JdbcConnection, which exists only in 6.0.x. The fixes need 8.0.28 or later.
• test/plugin/scenarios/** framework pins.

This PR is expected to close 13 of the 262 open Dependabot alerts: #1, #17, #23, #24, #406, #958, #1513, #1615, #2058, #2098, #79, #257 and #262.

• If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #. (No issue.)
• Update the CHANGES log. (Not updated: only test and CI dependencies change, and nothing shipped changes.)