From bac3285478a3046ef524ed5d420c74417e229470 Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Wed, 29 Nov 2023 00:03:39 -0500
Subject: [PATCH 01/12] update kubernetes java client to 19.0.0

---
 extensions-core/kubernetes-extensions/pom.xml | 13 +++++-
 .../k8s/discovery/DefaultK8sApiClient.java    |  7 ++-
 licenses.yaml                                 | 45 ++++++-------------
 3 files changed, 29 insertions(+), 36 deletions(-)

diff --git a/extensions-core/kubernetes-extensions/pom.xml b/extensions-core/kubernetes-extensions/pom.xml
index 895fb9f219e5..e43b6cc7879b 100644
--- a/extensions-core/kubernetes-extensions/pom.xml
+++ b/extensions-core/kubernetes-extensions/pom.xml
@@ -35,9 +35,20 @@
   </parent>
 
   <properties>
-    <kubernetes.client.version>11.0.4</kubernetes.client.version>
+    <kubernetes.client.version>19.0.0</kubernetes.client.version>
   </properties>
 
+
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+          <groupId>com.squareup.okhttp3</groupId>
+          <artifactId>okhttp</artifactId>
+          <version>4.12.0</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.druid</groupId>
diff --git a/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java b/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
index e17f8360e506..ee927bd5a3e2 100644
--- a/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
+++ b/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
@@ -65,7 +65,7 @@ public DefaultK8sApiClient(ApiClient realK8sClient, @Json ObjectMapper jsonMappe
   public void patchPod(String podName, String podNamespace, String jsonPatchStr)
   {
     try {
-      coreV1Api.patchNamespacedPod(podName, podNamespace, new V1Patch(jsonPatchStr), "true", null, null, null);
+      coreV1Api.patchNamespacedPod(podName, podNamespace, new V1Patch(jsonPatchStr), "true", null, null, null, false);
     }
     catch (ApiException ex) {
       throw new RE(ex, "Failed to patch pod[%s/%s], code[%d], error[%s].", podNamespace, podName, ex.getCode(), ex.getResponseBody());
@@ -80,8 +80,7 @@ public DiscoveryDruidNodeList listPods(
   )
   {
     try {
-      V1PodList podList = coreV1Api.listNamespacedPod(podNamespace, null, null, null, null, labelSelector, 0, null, null, null, null);
-      Preconditions.checkState(podList != null, "WTH: NULL podList");
+      V1PodList podList = coreV1Api.listNamespacedPod(podNamespace, null, null, null, null, labelSelector, 0, null, null, null, null, false);      Preconditions.checkState(podList != null, "WTH: NULL podList");
 
       Map<String, DiscoveryDruidNode> allNodes = new HashMap();
       for (V1Pod podDef : podList.getItems()) {
@@ -114,7 +113,7 @@ public WatchResult watchPods(String namespace, String labelSelector, String last
           Watch.createWatch(
               realK8sClient,
               coreV1Api.listNamespacedPodCall(namespace, null, true, null, null,
-                                              labelSelector, null, lastKnownResourceVersion, null, 0, true, null
+                                              labelSelector, null, lastKnownResourceVersion, null, true, 0, true, null
               ),
               new TypeReference<Watch.Response<V1Pod>>()
               {
diff --git a/licenses.yaml b/licenses.yaml
index fc73348bbc0c..e09b83005308 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -881,29 +881,12 @@ name: kubernetes official java client
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 11.0.4
+version: 19.0.0
 libraries:
   - io.kubernetes: client-java
-
----
-
-name: kubernetes official java client api
-license_category: binary
-module: extensions/druid-kubernetes-extensions
-license_name: Apache License version 2.0
-version: 11.0.4
-libraries:
   - io.kubernetes: client-java-api
-
----
-
-name: kubernetes official java client extended
-license_category: binary
-module: extensions/druid-kubernetes-extensions
-license_name: Apache License version 2.0
-version: 11.0.4
-libraries:
   - io.kubernetes: client-java-extended
+  - io.kubernetes: client-java-api-fluent
 
 ---
 
@@ -947,16 +930,6 @@ libraries:
 
 ---
 
-name: com.squareup.okio okio
-license_category: binary
-module: extensions/druid-kubernetes-extensions
-license_name: Apache License version 2.0
-version: 1.17.2
-libraries:
-  - com.squareup.okio: okio
-
----
-
 name: io.gsonfire gson-fire
 license_category: binary
 module: extensions/druid-kubernetes-extensions
@@ -1021,12 +994,22 @@ name: com.squareup.okhttp3 okhttp
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 3.14.9
+version: 4.12.0
 libraries:
   - com.squareup.okhttp3: okhttp
 
 ---
 
+name: com.squareup.okio okio
+license_category: binary
+module: extensions/druid-kubernetes-extensions
+license_name: Apache License version 2.0
+version: 3.2.0
+libraries:
+  - com.squareup.okio: okio
+  - com.squareup.okio: okio-jvm
+---
+
 name: io.prometheus simpleclient
 license_category: binary
 module: extensions/druid-kubernetes-extensions
@@ -4686,7 +4669,7 @@ libraries:
 
 ---
 
-name: Apache Lucene 
+name: Apache Lucene
 license_category: binary
 version: 8.4.0
 module: druid-ranger-security

From 9700b12921c66e817e0aed29ad032989efaa8489 Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Thu, 30 Nov 2023 11:12:46 -0500
Subject: [PATCH 02/12] fix indentation

---
 .../org/apache/druid/k8s/discovery/DefaultK8sApiClient.java    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java b/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
index ee927bd5a3e2..51af5e3f90a3 100644
--- a/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
+++ b/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
@@ -80,7 +80,8 @@ public DiscoveryDruidNodeList listPods(
   )
   {
     try {
-      V1PodList podList = coreV1Api.listNamespacedPod(podNamespace, null, null, null, null, labelSelector, 0, null, null, null, null, false);      Preconditions.checkState(podList != null, "WTH: NULL podList");
+      V1PodList podList = coreV1Api.listNamespacedPod(podNamespace, null, null, null, null, labelSelector, 0, null, null, null, null, false);
+      Preconditions.checkState(podList != null, "WTH: NULL podList");
 
       Map<String, DiscoveryDruidNode> allNodes = new HashMap();
       for (V1Pod podDef : podList.getItems()) {

From fd7c25d7309c5d2435a49fc9eb77d0806c99217c Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Thu, 7 Dec 2023 14:33:34 -0500
Subject: [PATCH 03/12] replace values of optional arguments with nulls

---
 .../org/apache/druid/k8s/discovery/DefaultK8sApiClient.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java b/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
index 51af5e3f90a3..ab2c3b20952c 100644
--- a/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
+++ b/extensions-core/kubernetes-extensions/src/main/java/org/apache/druid/k8s/discovery/DefaultK8sApiClient.java
@@ -65,7 +65,7 @@ public DefaultK8sApiClient(ApiClient realK8sClient, @Json ObjectMapper jsonMappe
   public void patchPod(String podName, String podNamespace, String jsonPatchStr)
   {
     try {
-      coreV1Api.patchNamespacedPod(podName, podNamespace, new V1Patch(jsonPatchStr), "true", null, null, null, false);
+      coreV1Api.patchNamespacedPod(podName, podNamespace, new V1Patch(jsonPatchStr), "true", null, null, null, null);
     }
     catch (ApiException ex) {
       throw new RE(ex, "Failed to patch pod[%s/%s], code[%d], error[%s].", podNamespace, podName, ex.getCode(), ex.getResponseBody());
@@ -80,7 +80,7 @@ public DiscoveryDruidNodeList listPods(
   )
   {
     try {
-      V1PodList podList = coreV1Api.listNamespacedPod(podNamespace, null, null, null, null, labelSelector, 0, null, null, null, null, false);
+      V1PodList podList = coreV1Api.listNamespacedPod(podNamespace, null, null, null, null, labelSelector, 0, null, null, null, null, null);
       Preconditions.checkState(podList != null, "WTH: NULL podList");
 
       Map<String, DiscoveryDruidNode> allNodes = new HashMap();
@@ -114,7 +114,7 @@ public WatchResult watchPods(String namespace, String labelSelector, String last
           Watch.createWatch(
               realK8sClient,
               coreV1Api.listNamespacedPodCall(namespace, null, true, null, null,
-                                              labelSelector, null, lastKnownResourceVersion, null, true, 0, true, null
+                                              labelSelector, null, lastKnownResourceVersion, null, null, 0, true, null
               ),
               new TypeReference<Watch.Response<V1Pod>>()
               {

From 034a655ad417af7d4d8f085e4f5c2ffb04afc5cd Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Thu, 7 Dec 2023 14:47:51 -0500
Subject: [PATCH 04/12] remove unnecessary bcprov and update docker-java

---
 extensions-core/kubernetes-extensions/pom.xml | 14 ++------------
 pom.xml                                       |  2 +-
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/extensions-core/kubernetes-extensions/pom.xml b/extensions-core/kubernetes-extensions/pom.xml
index e43b6cc7879b..62be4dc4ede2 100644
--- a/extensions-core/kubernetes-extensions/pom.xml
+++ b/extensions-core/kubernetes-extensions/pom.xml
@@ -41,6 +41,8 @@
 
   <dependencyManagement>
     <dependencies>
+      <!-- This is an indirect dependency of io.kubernetes.client-java
+      update to address vulnerability in transitive dependency okio used by okhttp -->
       <dependency>
           <groupId>com.squareup.okhttp3</groupId>
           <artifactId>okhttp</artifactId>
@@ -91,18 +93,6 @@
       <scope>test</scope>
     </dependency>
 
-    <!-- Version override to address CVE-2020-28052 -->
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-jdk15on</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-ext-jdk15on</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-
     <!-- others -->
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
diff --git a/pom.xml b/pom.xml
index b8a503f7c57d..401ef8767986 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1104,7 +1104,7 @@
             <dependency>
                 <groupId>com.github.docker-java</groupId>
                 <artifactId>docker-java-bom</artifactId>
-                <version>3.2.13</version>
+                <version>3.3.4</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>

From 7fd2fc9a690d6af2029f987f5de589e8348eb371 Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Thu, 7 Dec 2023 20:05:54 -0500
Subject: [PATCH 05/12] fix licenses, suppressions, add version definitions

---
 extensions-core/protobuf-extensions/pom.xml |  12 ++
 licenses.yaml                               | 134 +++++++++++---------
 owasp-dependency-check-suppressions.xml     |  15 +--
 pom.xml                                     |  21 +--
 4 files changed, 91 insertions(+), 91 deletions(-)

diff --git a/extensions-core/protobuf-extensions/pom.xml b/extensions-core/protobuf-extensions/pom.xml
index ad0d4396ebd3..9308e9c7f6c3 100644
--- a/extensions-core/protobuf-extensions/pom.xml
+++ b/extensions-core/protobuf-extensions/pom.xml
@@ -36,6 +36,7 @@
 
   <properties>
     <commons-io.version>2.11.0</commons-io.version>
+    <okio.version>3.4.0</okio.version>
   </properties>
 
   <repositories>
@@ -45,6 +46,17 @@
     </repository>
   </repositories>
 
+  <dependencyManagement>
+    <dependencies>
+      <!-- This is an indirect dependency of kafka-protobuf-provider
+      update to address vulnerability in transitive dependency okio  -->
+      <dependency>
+          <groupId>com.squareup.okio</groupId>
+          <artifactId>okio</artifactId>
+          <version>3.4.0</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
   <dependencies>
     <dependency>
       <groupId>org.apache.druid</groupId>
diff --git a/licenses.yaml b/licenses.yaml
index bd869346bc85..26c6517caa72 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -843,6 +843,16 @@ libraries:
 
 ---
 
+name: kubernetes fabric java client
+license_category: binary
+module: extensions-contrib/kubernetes-overlord-extensions
+license_name: Apache License version 2.0
+version: 6.7.2
+libraries:
+  - io.fabric8: kubernetes-client
+
+---
+
 name: kubernetes official java client
 license_category: binary
 module: extensions/druid-kubernetes-extensions
@@ -853,26 +863,18 @@ libraries:
   - io.kubernetes: client-java-api
   - io.kubernetes: client-java-extended
   - io.kubernetes: client-java-api-fluent
+  - io.kubernetes: client-java-proto
 
 ---
 
-name: kubernetes fabric java client
-license_category: binary
-module: extensions-contrib/kubernetes-overlord-extensions
-license_name: Apache License version 2.0
-version: 6.7.2
-libraries:
-  - io.fabric8: kubernetes-client
-
----
-
-name: io.prometheus simpleclient_common
+name: Swagger
+version: 1.6.2
 license_category: binary
-module: extensions/druid-kubernetes-extensions
+module: extensions/druid-avro-extensions
 license_name: Apache License version 2.0
-version: 0.9.0
 libraries:
-  - io.prometheus: simpleclient_common
+  - io.swagger: swagger-core
+  - io.swagger: swagger-models
 
 ---
 
@@ -920,7 +922,7 @@ name: io.swagger swagger-annotations
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 1.6.2
+version: 1.6.11
 libraries:
   - io.swagger: swagger-annotations
 
@@ -930,22 +932,23 @@ name: io.swagger swagger-annotations
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 2.8.6
+version: 1.6.2
 libraries:
-  - com.google.code.gson: gson
+  - io.swagger: swagger-annotations
 
 ---
 
-name: io.prometheus simpleclient_httpserver
+name: io.swagger swagger-annotations
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 0.9.0
+version: 2.8.6
 libraries:
-  - io.prometheus: simpleclient_httpserver
+  - com.google.code.gson: gson
 
 ---
 
+
 name: org.bitbucket.b_c jose4j
 license_category: binary
 module: extensions/druid-kubernetes-extensions
@@ -964,6 +967,7 @@ version: 2.2.1
 libraries:
   - org.joda: joda-convert
 
+
 ---
 
 name: com.squareup.okhttp3 okhttp
@@ -973,36 +977,44 @@ license_name: Apache License version 2.0
 version: 4.12.0
 libraries:
   - com.squareup.okhttp3: okhttp
+  - com.squareup.okhttp3: logging-interceptor
 
 ---
 
-name: com.squareup.okio okio
+name: com.squareup.okhttp3 okhttp logging-interceptor
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 3.2.0
+version: 4.11.0
 libraries:
-  - com.squareup.okio: okio
-  - com.squareup.okio: okio-jvm
+  - com.squareup.okhttp3: logging-interceptor
+
 ---
 
-name: io.prometheus simpleclient
+name: com.squareup.okio okio
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 0.9.0
+version: 3.6.0
 libraries:
-  - io.prometheus: simpleclient
+  - com.squareup.okio: okio
+  - com.squareup.okio: okio-jvm
 
 ---
 
-name: io.kubernetes client-java-proto
+name: io.prometheus simpleclient
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 11.0.4
+version: 0.16.0
 libraries:
-  - io.kubernetes: client-java-proto
+  - io.prometheus: simpleclient
+  - io.prometheus: simpleclient_common
+  - io.prometheus: simpleclient_httpserver
+  - io.prometheus: simpleclient_tracer_common
+  - io.prometheus: simpleclient_tracer_otel
+  - io.prometheus: simpleclient_tracer_otel_agent
+
 
 ---
 
@@ -1020,70 +1032,76 @@ name: com.flipkart.zjsonpatch zjsonpatch
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: Apache License version 2.0
-version: 0.4.11
+version: 0.4.14
 libraries:
   - com.flipkart.zjsonpatch: zjsonpatch
 
 ---
 
-
-name: org.bouncycastle bcprov-jdk15on
+name: org.bouncycastle bcprov-jdk18on
 license_category: binary
 module: extensions/druid-kubernetes-extensions
 license_name: MIT License
-version: "1.70"
+version: "1.76"
 libraries:
-  - org.bouncycastle: bcprov-jdk15on
-
+  - org.bouncycastle: bcprov-jdk18on
+  - org.bouncycastle: bcprov-ext-jdk18on
+  - org.bouncycastle: bcpkix-jdk18on
+  - org.bouncycastle: bcutil-jdk18on
 ---
 
-name: org.bouncycastle bcprov-ext-jdk15on
+
+name: com.github.vladimir-bukhtoyarov bucket4j-core
 license_category: binary
 module: extensions/druid-kubernetes-extensions
-license_name: MIT License
-version: "1.70"
+license_name: Apache License version 2.0
+version: 7.6.0
 libraries:
-  - org.bouncycastle: bcprov-ext-jdk15on
+  - com.github.vladimir-bukhtoyarov: bucket4j-core
 
 ---
 
-name: org.bouncycastle bcpkix-jdk15on
+name: Jetbrains Annotations
 license_category: binary
 module: extensions/druid-kubernetes-extensions
-license_name: MIT License
-version: "1.70"
+module: extensions/kubernetes-extensions
+license_name: Apache License version 2.0
+version: 13.0
 libraries:
-  - org.bouncycastle: bcpkix-jdk15on
+  - org.jetbrains: annotations
+
 
 ---
 
-name: org.bouncycastle bcutil-jdk15on
+name: Jetbrains kotlin-stdlib
 license_category: binary
-module: extensions/druid-kubernetes-extensions
-license_name: MIT License
-version: "1.70"
+module: extensions/kubernetes-extensions
+license_name: Apache License version 2.0
+version: 1.6.10
 libraries:
-  - org.bouncycastle: bcutil-jdk15on
+  - org.jetbrains.kotlin: kotlin-stdlib
 
 ---
 
-name: com.squareup.okhttp3 logging-interceptor
+name: Jetbrains kotlin-stdlib common
 license_category: binary
-module: extensions/druid-kubernetes-extensions
+module: extensions/kubernetes-extensions
 license_name: Apache License version 2.0
-version: 3.14.9
+version: 1.9.10
 libraries:
-  - com.squareup.okhttp3: logging-interceptor
+  - org.jetbrains.kotlin: kotlin-stdlib-common
 
 ---
-
-name: com.github.vladimir-bukhtoyarov bucket4j-core
+name: Jetbrains  jdk7 jdk 8
 license_category: binary
-module: extensions/druid-kubernetes-extensions
+module: extensions/kubernetes-extensions
 license_name: Apache License version 2.0
-version: 4.10.0
+version: 1.8.21
 libraries:
-  - com.github.vladimir-bukhtoyarov: bucket4j-core
+  - org.jetbrains.kotlin: kotlin-stdlib
+  - org.jetbrains.kotlin: kotlin-stdlib-common
+  - org.jetbrains.kotlin: kotlin-stdlib-jdk7
+  - org.jetbrains.kotlin: kotlin-stdlib-jdk8
 
 ---
 
diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index f9c3146e3588..4d68252dcf49 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -440,9 +440,10 @@
     <cve>CVE-2021-4277</cve>
   </suppress>
 
+<!-- the remaining uses of vulnerable okio are in contrib-extensions -->
   <suppress>
     <notes><![CDATA[
-      file name: okio-1.17.2.jar, okio-1.15.0.jar okio 2.8.0
+      file name: okio-1.17.2.jar, okio-1.15.0.jar
     ]]></notes>
     <packageUrl regex="true">^pkg:maven/com\.squareup\.okio/okio@..*$</packageUrl>
     <cve>CVE-2023-3635</cve>  <!-- Suppressed since okio requests in Druid are internal, and not user-facing -->
@@ -460,18 +461,6 @@
     <cve>CVE-2023-5072</cve>
   </suppress>
 
-  <!--
-    ~ CVE-2023-44981 seems to affect Zookeeper servers. While we ship with a previous version of the Zookeeper, Druid only
-    ~ only uses the client classes of the Zookeeper. We do use the older version in the quickstart & example docker file,
-    ~ however in production it is recomended to use your own Zookeeper server with the CVE patched up, which the Druid's
-    ~ older ZK library is still compatible with.
-    -->
-  <suppress>
-    <notes><![CDATA[
-      file name: zookeeper-3.8.3.jar
-    ]]></notes>
-    <cve>CVE-2023-44981</cve>
-  </suppress>
 
   <!--
    ~ Hostname verification is disabled by default in Netty 4.x, therefore the version that Druid is using gets flagged,
diff --git a/pom.xml b/pom.xml
index 401ef8767986..bf6f5d0a0576 100644
--- a/pom.xml
+++ b/pom.xml
@@ -369,26 +369,7 @@
                 <artifactId>snakeyaml</artifactId>
                 <version>1.33</version>
             </dependency>
-            <dependency>
-                <groupId>org.bouncycastle</groupId>
-                <artifactId>bcprov-jdk15on</artifactId>
-                <version>1.70</version>
-            </dependency>
-            <dependency>
-                <groupId>org.bouncycastle</groupId>
-                <artifactId>bcprov-ext-jdk15on</artifactId>
-                <version>1.70</version>
-            </dependency>
-            <dependency>
-                <groupId>org.bouncycastle</groupId>
-                <artifactId>bcpkix-jdk15on</artifactId>
-                <version>1.70</version>
-            </dependency>
-            <dependency>
-                <groupId>org.bouncycastle</groupId>
-                <artifactId>bcutil-jdk15on</artifactId>
-                <version>1.70</version>
-            </dependency>
+
             <!-- transitive dependency of testng
             this would be resolved by updating
             testng to 7.8.0 -->

From ac12e24578c48b5233ce156d78a7fc55ef654f55 Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Thu, 7 Dec 2023 21:10:06 -0500
Subject: [PATCH 06/12] add pluginmanagement ignore for a false positive

---
 extensions-core/kubernetes-extensions/pom.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/extensions-core/kubernetes-extensions/pom.xml b/extensions-core/kubernetes-extensions/pom.xml
index 62be4dc4ede2..3d050325526d 100644
--- a/extensions-core/kubernetes-extensions/pom.xml
+++ b/extensions-core/kubernetes-extensions/pom.xml
@@ -138,6 +138,19 @@
   </dependencies>
 
   <build>
+    <pluginManagement>
+        <plugins>
+          <plugin>
+              <groupId>org.apache.maven.plugins</groupId>
+              <artifactId>maven-dependency-plugin</artifactId>
+              <version>3.1.1</version>
+              <configuration>
+              <!-- analyze incorrectly flags this dependency -->
+                <ignoredDependencies>io.kubernetes:client-java-api-fluent:jar:19.0.0</ignoredDependencies>
+              </configuration>
+          </plugin>
+        </plugins>
+    </pluginManagement>
     <plugins>
       <plugin>
         <groupId>org.jacoco</groupId>

From e732f713b740dc390b667bd2a741ead64bece222 Mon Sep 17 00:00:00 2001
From: Jan Werner <105367074+janjwerner-confluent@users.noreply.github.com>
Date: Fri, 8 Dec 2023 15:49:19 -0500
Subject: [PATCH 07/12] Update extensions-core/kubernetes-extensions/pom.xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Xavier Léauté <xl+github@xvrl.net>
---
 extensions-core/kubernetes-extensions/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions-core/kubernetes-extensions/pom.xml b/extensions-core/kubernetes-extensions/pom.xml
index 3d050325526d..5c25e7a36eef 100644
--- a/extensions-core/kubernetes-extensions/pom.xml
+++ b/extensions-core/kubernetes-extensions/pom.xml
@@ -145,7 +145,7 @@
               <artifactId>maven-dependency-plugin</artifactId>
               <version>3.1.1</version>
               <configuration>
-              <!-- analyze incorrectly flags this dependency -->
+              <!-- analyze incorrectly flags this dependency as missing when omitted, and unused when declared -->
                 <ignoredDependencies>io.kubernetes:client-java-api-fluent:jar:19.0.0</ignoredDependencies>
               </configuration>
           </plugin>

From 8800ddeb86357dedcc29496ff428697182d12eae Mon Sep 17 00:00:00 2001
From: Jan Werner <105367074+janjwerner-confluent@users.noreply.github.com>
Date: Fri, 8 Dec 2023 15:49:28 -0500
Subject: [PATCH 08/12] Update extensions-core/protobuf-extensions/pom.xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Xavier Léauté <xl+github@xvrl.net>
---
 extensions-core/protobuf-extensions/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions-core/protobuf-extensions/pom.xml b/extensions-core/protobuf-extensions/pom.xml
index 9308e9c7f6c3..e5b171587e32 100644
--- a/extensions-core/protobuf-extensions/pom.xml
+++ b/extensions-core/protobuf-extensions/pom.xml
@@ -53,7 +53,7 @@
       <dependency>
           <groupId>com.squareup.okio</groupId>
           <artifactId>okio</artifactId>
-          <version>3.4.0</version>
+          <version>${okio.version}</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

From 0afb744c90715085a309a313f46dfcc9403341b5 Mon Sep 17 00:00:00 2001
From: Jan Werner <105367074+janjwerner-confluent@users.noreply.github.com>
Date: Fri, 8 Dec 2023 15:49:44 -0500
Subject: [PATCH 09/12] Update extensions-core/kubernetes-extensions/pom.xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Xavier Léauté <xl+github@xvrl.net>
---
 extensions-core/kubernetes-extensions/pom.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/extensions-core/kubernetes-extensions/pom.xml b/extensions-core/kubernetes-extensions/pom.xml
index 5c25e7a36eef..304a5af0a7a9 100644
--- a/extensions-core/kubernetes-extensions/pom.xml
+++ b/extensions-core/kubernetes-extensions/pom.xml
@@ -143,7 +143,6 @@
           <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-dependency-plugin</artifactId>
-              <version>3.1.1</version>
               <configuration>
               <!-- analyze incorrectly flags this dependency as missing when omitted, and unused when declared -->
                 <ignoredDependencies>io.kubernetes:client-java-api-fluent:jar:19.0.0</ignoredDependencies>

From a34e7370dfbe8438ba44cea98d1d8e1317971dba Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Sat, 9 Dec 2023 14:08:26 -0500
Subject: [PATCH 10/12] remove the dependencymanagement override for the
 provided dependency

---
 extensions-core/protobuf-extensions/pom.xml | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/extensions-core/protobuf-extensions/pom.xml b/extensions-core/protobuf-extensions/pom.xml
index e5b171587e32..25fd79244de7 100644
--- a/extensions-core/protobuf-extensions/pom.xml
+++ b/extensions-core/protobuf-extensions/pom.xml
@@ -46,17 +46,6 @@
     </repository>
   </repositories>
 
-  <dependencyManagement>
-    <dependencies>
-      <!-- This is an indirect dependency of kafka-protobuf-provider
-      update to address vulnerability in transitive dependency okio  -->
-      <dependency>
-          <groupId>com.squareup.okio</groupId>
-          <artifactId>okio</artifactId>
-          <version>${okio.version}</version>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
   <dependencies>
     <dependency>
       <groupId>org.apache.druid</groupId>

From f86c8d0d1e1ea06d121708406dac9fc6c4acd395 Mon Sep 17 00:00:00 2001
From: Jan Werner <jwerner@confluent.io>
Date: Sun, 10 Dec 2023 12:43:46 -0500
Subject: [PATCH 11/12] re-adding okio definition

---
 extensions-core/protobuf-extensions/pom.xml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/extensions-core/protobuf-extensions/pom.xml b/extensions-core/protobuf-extensions/pom.xml
index 25fd79244de7..b16fc333b749 100644
--- a/extensions-core/protobuf-extensions/pom.xml
+++ b/extensions-core/protobuf-extensions/pom.xml
@@ -36,7 +36,7 @@
 
   <properties>
     <commons-io.version>2.11.0</commons-io.version>
-    <okio.version>3.4.0</okio.version>
+    <okio.version>3.6.0</okio.version>
   </properties>
 
   <repositories>
@@ -46,6 +46,20 @@
     </repository>
   </repositories>
 
+  <dependencyManagement>
+    <dependencies>
+      <!-- This is an indirect dependency of kafka-protobuf-provider
+      update to address vulnerability in transitive dependency okio  -->
+      <dependency>
+          <groupId>com.squareup.okio</groupId>
+          <artifactId>okio</artifactId>
+          <version>${okio.version}</version>
+          <scope>provided</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+
   <dependencies>
     <dependency>
       <groupId>org.apache.druid</groupId>

From e7b94a68f9a96d1f0dd3081dac2757ff1b97278c Mon Sep 17 00:00:00 2001
From: Jan Werner <105367074+janjwerner-confluent@users.noreply.github.com>
Date: Tue, 12 Dec 2023 11:08:37 -0500
Subject: [PATCH 12/12] Update extensions-core/protobuf-extensions/pom.xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Xavier Léauté <xl+github@xvrl.net>
---
 extensions-core/protobuf-extensions/pom.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/extensions-core/protobuf-extensions/pom.xml b/extensions-core/protobuf-extensions/pom.xml
index b16fc333b749..091b6b133efb 100644
--- a/extensions-core/protobuf-extensions/pom.xml
+++ b/extensions-core/protobuf-extensions/pom.xml
@@ -54,7 +54,6 @@
           <groupId>com.squareup.okio</groupId>
           <artifactId>okio</artifactId>
           <version>${okio.version}</version>
-          <scope>provided</scope>
       </dependency>
     </dependencies>
   </dependencyManagement>