chore(deps): Upgrade zookeeper version from 3.9.4 to 3.9.5 address the CVE-2026-24281 and CVE-2026-24308

[NivinCS]

Description

Upgraded zookeeper version to 3.9.5 to resolve the CVE-2026-24281 and CVE-2026-24308

Motivation and Context

Impact

Test Plan

Regression test suite report for Kafka connector

pinot connector

WhitesSource Security check report

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.
• If adding new dependencies, verified they have an OpenSSF Scorecard score of 5.0 or higher (or obtained explicit TSC approval for lower scores).

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes
* Upgrade zookeeper to version 3.9.5 in response to `CVE-2026-24281 <https://github.com/advisories/GHSA-7xrh-hqfc-g7qr>`,`CVE-2026-24308 <https://github.com/advisories/GHSA-crhr-qqj8-rpxc>`

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: NivinCS / name: Nivin C S (c576592)

[agrawalreetika]

I see the zookeeper also gets included from pinot-common as a transitive dependency, so check if any update is needed there?

[NivinCS]

I see the zookeeper also gets included from pinot-common as a transitive dependency, so check if any update is needed there?

Pinot is already using the Zookeeper version specified in the root pom, so no additional change is required from our side.
Also, the CVE we observed was introduced transitively through pinot-common, which in turn resolves to the Zookeeper version defined in the root pom. Therefore, it already aligns with the updated version and no further action is needed.

[pratyakshsharma]

Did we verify this does not break anything when using this connector?

[NivinCS]

I executed the regression test suite, and all test cases passed. Test report is included here #27319 (comment)

[ScrapCodes]

Since tests are good, this should be okay.

[ScrapCodes]

Looks good!