[2.19] Resolve CVEs by bumping dependencies

[DarshitChanpura]

Summary

Bump dependency versions to resolve 10 CVEs on the 2.19 branch.

CVEs Addressed

CVE	Library	Vulnerability	Fixed Version
CVE-2026-5598	Bouncy Castle	Timing side-channel in FrodoKEM (private key leakage)	1.84
CVE-2026-0636	Bouncy Castle	LDAP injection in LDAPStoreHelper	1.84
CVE-2026-5588	Bouncy Castle	CompositeVerifier accepts empty signature as valid	1.84
CVE-2026-34477	log4j-core	TLS hostname verification bypass	2.25.4
CVE-2026-34478	log4j-core	Log injection via CRLF in Rfc5424Layout	2.25.4
CVE-2026-34480	log4j-core	XmlLayout fails to sanitize forbidden XML chars	2.25.4
CVE-2026-24281	ZooKeeper	Authentication bypass via reverse DNS fallback	3.9.5
CVE-2026-24308	ZooKeeper	Sensitive config values exposed in logs	3.9.5
CVE-2025-67030	plexus-utils	Directory traversal via Expand.extractFile	3.6.1
CVE-2026-33870	Netty	HTTP request smuggling	Already fixed (4.1.135.Final ≥ 4.1.132.Final)

Changes

• Bouncy Castle (bcprov, bcpkix, bcutil): 1.82 → 1.84
• log4j-core + log4j-api: 2.25.3 → 2.25.4
• ZooKeeper: 3.9.4 → 3.9.5
• plexus-utils: 3.1.1 → 3.6.1
• netty-tcnative-boringssl-static: 2.0.70.Final → 2.0.74.Final (resolves transitive conflict from ZooKeeper 3.9.5)

Testing

• ./gradlew clean compileJava compileTestJava compileIntegrationTestJava passes
• ./gradlew assemble passes
• Dependency resolution (./gradlew :dependencies) passes with no conflicts

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit cfaba3e.

Path	Line	Severity	Description
.github/workflows/plugin_install.yml	46	high	Action owner changed: derek-ho/start-opensearch replaced with opensearch-project/opensearch-build/.github/actions/start-opensearch — different repository owner and path, not just a version pin. Maintainers must verify the new action is trustworthy.
.github/workflows/plugin_install.yml	56	high	Same owner/path change as above for the Windows runner path: derek-ho/start-opensearch@v7 replaced with opensearch-project/opensearch-build@58029ed.
.github/workflows/ci.yml	63	high	gradle/gradle-build-action replaced with gradle/actions/setup-gradle — different action path within the same org. Dependency change; maintainers must confirm the SHA d9c87d481d55275bb5441eef3fe0e46805f9ef70 matches the intended v3.5.0 release.
.github/workflows/maven-publish.yml	29	high	1password/load-secrets-action pinned to SHA 581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 — this action handles secrets export; maintainers must verify the SHA corresponds to the declared v2 tag.
.github/workflows/maven-publish.yml	35	high	aws-actions/configure-aws-credentials pinned to SHA 61815dcd50bd041e203e49132bacad1fd04d2708 — handles AWS role assumption; SHA must be verified against the v5 release.
.github/workflows/auto-release.yml	15	high	tibdex/github-app-token pinned to SHA 3beb63f4bd073e61482598c45c71c1019b59b73a — third-party action that handles GitHub App private keys; SHA must be verified against v2.1.0.
.github/workflows/backport.yml	24	high	VachaShah/backport pinned to SHA 142d3b8a8c70dc54db515e653e5ed3c3fac64100 — third-party action operating with an elevated GitHub App token; SHA must be verified against v2.2.0.
.github/workflows/automatic-merges.yml	22	high	peternied/discerning-merger pinned to SHA 07eafb14c195a2c23b291f6b008a686589cfb545 — performs automated merges with write permissions; SHA must be verified against v3.
.github/workflows/ci.yml	84	high	Wandalen/wretry.action pinned to SHA e68c23e6309f2871ca8ae4763e7629b9c258e1ea — third-party retry wrapper; SHA must be verified against v3.8.0.
.github/workflows/code-hygiene.yml	14	high	fernandrone/linelint pinned to SHA 7907a5dca0c28ea7dd05c6d8d8cacded713aca11 — third-party linting action; SHA must be verified against version 0.0.6.

The table above displays the top 10 most important findings.

Total: 26 | Critical: 0 | High: 26 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 12a528d)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Latest suggestions up to 12a528d
Explore these optional code suggestions:

Category	Suggestion	Impact
General	Verify cross-platform action compatibility Both Windows and non-Windows steps use the same action reference but were previously using different versions (v6 vs v7). Verify that the unified commit SHA supports both platforms correctly, as the version difference may have addressed platform-specific issues. .github/workflows/plugin_install.yml [53-54] - name: Run Opensearch with A Single Plugin - uses: opensearch-project/opensearch-build/.github/actions/start-opensearch@58029ed0db12929e8e920eb875925335583f9490 + uses: opensearch-project/opensearch-build/.github/actions/start-opensearch@v1.0.0 # Verify platform compatibility if: ${{ runner.os == 'Windows' }} Suggestion importance[1-10]: 6 __ Why: Valid concern about unifying previously different versions (v6 vs v7) into a single commit SHA. The suggestion to verify platform compatibility is reasonable, though the improved code doesn't align with the PR's pinning strategy. This warrants verification but may have been intentionally unified.	Low
	Use versioned action reference The action reference uses a commit SHA from a different repository without version pinning. This creates a maintenance risk as the commit may be removed or the action may change unexpectedly. Consider using a tagged version or documenting the rationale for using this specific commit. .github/workflows/plugin_install.yml [43-44] - name: Run Opensearch with A Single Plugin - uses: opensearch-project/opensearch-build/.github/actions/start-opensearch@58029ed0db12929e8e920eb875925335583f9490 + uses: opensearch-project/opensearch-build/.github/actions/start-opensearch@v1.0.0 # Replace with actual stable version tag if: ${{ runner.os != 'Windows' }} Suggestion importance[1-10]: 5 __ Why: The suggestion correctly identifies that using a commit SHA instead of a version tag can create maintenance challenges. However, the PR intentionally pins to commit SHAs for security and reproducibility, which is a valid practice. The suggestion's improved code doesn't match the PR's approach of using commit SHAs with comments.	Low

---

Previous suggestions

Suggestions up to commit 21c27bd

Category	Suggestion	Impact
General	Isolate Gradle configuration to project scope The init.gradle configuration is written to a global location (~/.gradle) which may affect other builds or persist across workflow runs. Consider using a project-specific location or the GRADLE_USER_HOME environment variable to isolate this configuration to the current build context. .github/actions/create-bwc-build/action.yaml [46-52] - name: Build run: | cd ${{ inputs.plugin-branch }} - mkdir -p ~/.gradle - echo "allprojects { buildscript { repositories { maven { url 'https://ci.opensearch.org/ci/dbc/snapshots/maven/' } } } }" > ~/.gradle/init.gradle - ./gradlew assemble + mkdir -p .gradle + echo "allprojects { buildscript { repositories { maven { url 'https://ci.opensearch.org/ci/dbc/snapshots/maven/' } } } }" > .gradle/init.gradle + ./gradlew assemble -g .gradle shell: bash Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies that writing to ~/.gradle could affect other builds. However, the improved code's approach of using .gradle and -g .gradle may not work as intended since Gradle expects GRADLE_USER_HOME to be set or the default location. A better solution would be to use GRADLE_USER_HOME environment variable or ensure proper cleanup.	Low
	Use versioned action reference instead of SHA The action reference uses a commit SHA from a different repository without version pinning or tag reference. This makes it difficult to track which version is being used and may cause unexpected behavior if the commit is force-pushed or deleted. Consider using a tagged release or documenting the version. .github/workflows/plugin_install.yml [43-44] - name: Run Opensearch with A Single Plugin - uses: opensearch-project/opensearch-build/.github/actions/start-opensearch@58029ed0db12929e8e920eb875925335583f9490 + uses: opensearch-project/opensearch-build/.github/actions/start-opensearch@v1.0.0 # Update to actual version tag if: ${{ runner.os != 'Windows' }} Suggestion importance[1-10]: 4 __ Why: While using tagged versions is generally preferred, the PR intentionally uses commit SHAs for security and reproducibility (as seen throughout the PR). The suggestion contradicts the PR's approach of pinning to specific commits. Additionally, the improved_code references a non-existent version tag v1.0.0.	Low

[github-actions]

Persistent review updated to latest commit 12a528d