[wu-sheng]

Follow-up to #846. Bumps the vulnerable test and tooling dependencies that OSV-Scanner still reports on main. Nothing shipped in the agent changes.

Dependencies

Plugin-test tooling, test/plugin/pom.xml (inherited by runner-helper, agent-test-tools, containers/*; the tooling is still built on JDK 8 in CI and all new versions have Java 8-compatible baseline classes (Guava and Log4j add a Java 9 module-info.class; FreeMarker is a multi-release JAR)):

Package	Old	New	Advisories
junit:junit	4.11	4.13.2	GHSA-269g-pwp5-87pp (CVE-2020-15250)
com.google.guava:guava	30.1.1-jre	33.7.2-jre	GHSA-5mg8-w23w-74h3 (CVE-2020-8908), GHSA-7g45-4rm6-3mm3 (CVE-2023-2976), GHSA-xxph-c9ww-hj94 (CVE-2026-102554)
org.yaml:snakeyaml	1.24	2.7	GHSA-mjmj-j48q-9wg2 (CVE-2022-1471), GHSA-3mc7-4q67-w48m (CVE-2022-25857), GHSA-98wm-3w3q-mw94 (CVE-2022-38751), GHSA-9w3m-gqgf-c4p9 (CVE-2022-38752), GHSA-c4r9-r8fh-9vj2 (CVE-2022-38749), GHSA-hhhw-99gj-p3c3 (CVE-2022-38750), GHSA-rvwf-54qp-4r6v (CVE-2017-18640), GHSA-w37g-rhq8-7m4j (CVE-2022-41854)

The runner-helper only uses new Yaml().loadAs(reader, CaseConfiguration.class), which snakeyaml 2.x keeps, so no code change is needed.

test/plugin/runner-helper/pom.xml:

Package	Old	New	Advisories
org.freemarker:freemarker	2.3.28	2.3.35	GHSA-27j2-h3m2-8237 (CVE-2026-84939)
junit:junit (test)	4.12	4.13.2	GHSA-269g-pwp5-87pp (CVE-2020-15250)

test/plugin/archetypes/tomcat/src/main/resources/archetype-resources/pom.xml: org.apache.logging.log4j:log4j-core and log4j-api 2.8.1 -> 2.25.5 (the version test/plugin/pom.xml uses since #846), GHSA-jfh8-c2jp-5v3q (CVE-2021-44228), GHSA-7rjr-3q55-vv33 (CVE-2021-45046), GHSA-p6xc-xr62-6r2g (CVE-2021-45105), GHSA-8489-44mv-ggj8 (CVE-2021-44832), GHSA-fxph-q3j8-mv87 (CVE-2017-5645), GHSA-vwqq-5vrc-xw9h (CVE-2020-9488), GHSA-vc5p-v9hr-52mj (CVE-2025-68161), GHSA-3pxv-7cmr-fjr4 (CVE-2026-34480), GHSA-h383-gmxw-35v2 (CVE-2026-34479).

Unit-test junit.version overrides 4.12 -> 4.13.2 (GHSA-269g-pwp5-87pp, CVE-2020-15250), matching the root pom: apm-sniffer/apm-sdk-plugin/httpClient-4.x-plugin, httpclient-5.x-plugin, solon-2.x-plugin, websphere-liberty-23.x-plugin, and apm-sniffer/apm-test-tools.

E2E services:

• test/e2e/base/provider/pom.xml: ch.qos.logback:logback-classic 1.2.3 -> 1.2.13, GHSA-vmq6-5m68-f53m (CVE-2023-6378). The logback.version property also manages logback-core through the Spring Boot parent, so both move to 1.2.13.
• test/e2e/base/pom.xml: com.google.guava:guava 30.1.1-jre -> 33.7.2-jre for the provider and consumer, same advisories as above. OSV does not report this one because it cannot resolve the property without the remote Spring Boot parent; it is the same direct dependency as in the plugin tooling.

Manifests touched: test/plugin/pom.xml, test/plugin/runner-helper/pom.xml, test/plugin/archetypes/tomcat/src/main/resources/archetype-resources/pom.xml, the five module poms above, test/e2e/base/pom.xml, test/e2e/base/provider/pom.xml.

Left out on purpose

• Provided-scope plugin and toolkit dependencies (including log4j-core in toolkit-log4j-2.x, guava in guava-eventbus-plugin, mariadb-java-client in mariadb-3.x-plugin, spring-context in motan-plugin, the mysql range in jdbc-commons, micrometer-core): compile-only compatibility targets, not shipped.
• test/plugin/scenarios/**: scenarios pin the framework versions they test.
• com.h2database:h2 1.4.199 in the E2E provider: every fix is in H2 2.x. H2 2.x reserves USER, the table name of the provider's User entity, and needs Hibernate 5.6.5+, while the E2E services' Spring Boot 2.2.5 parent pins Hibernate 5.4.12. Not a trivial bump.
• log4j:log4j 1.2.17 and the provided log4j-core 2.7 in the E2E provider: log4j 1.x has no fixed release, and both are the logging frameworks the toolkit E2E exercises.

GitHub Actions

No changes. All uses: were made current in #846 and still are: actions/* and github/codeql-action are on their latest majors, and the docker actions and apache/skywalking-eyes are pinned to ASF-approved SHAs with no expiry.

infra-e2e

Already on apache/skywalking-infra-e2e@56ac8befeb5f910f2dc9339e65d07cd18953f90e. No change. E2E passed on main at 09d7f0b.

License

No change. Only test and tooling dependencies move, and the dist LICENSE in dist-material is not generated from these modules.

Changelog

None: test and tooling dependencies only.

Verified locally

• ./mvnw -f test/plugin/pom.xml -pl runner-helper,containers,containers/jvm-container,containers/tomcat-container -Dmaven.test.skip compile dependency:list on JDK 8: build and checkstyle pass, resolves junit 4.13.2, guava 33.7.2-jre, snakeyaml 2.7, freemarker 2.3.35.
• Built plugin-runner-helper.jar on JDK 8 from main and from this branch and ran both against the configuration.yml of all 198 scenarios under test/plugin/scenarios: every run succeeds and the generated docker-compose.yml and scenario.sh are identical.
• ./mvnw -f test/plugin/pom.xml -pl runner-helper verify on JDK 8: same result as on main. 4 tests, with the same 1 error in DockerContainerRunningGeneratorTest (Mockito UnnecessaryStubbingException), which already fails on main. CI skips these tests.
• ./mvnw -pl <the five modules> -am test on JDK 17 (the CI version): all tests pass (httpclient-4.x 9, httpclient-5.x 63, websphere-liberty-23.x 6, apm-agent-core 97). On main these modules cannot run their tests on JDK 8 either, because the root build uses --release 8 and Mockito 5.
• ./mvnw -f test/e2e/base/pom.xml -Dsw.version=9.8.0 package on JDK 8, then started the provider and consumer on 127.0.0.1 and called /health, /users and /info through the consumer: all succeed with logback 1.2.13 and guava 33.7.2-jre.
• OSV-Scanner (scan source --no-resolve) on this branch: every finding listed above is gone. The only findings left in these manifests are the E2E provider's h2, log4j 1.2.17 and provided log4j-core.

Not verified locally: the plugin test containers and E2E runs (they need Docker), which CI covers.