From 5fb18c600839ad00c487cfd0aac2ffcab1037a0d Mon Sep 17 00:00:00 2001
From: Andreas Maechler <amaechler@gmail.com>
Date: Wed, 13 Aug 2025 13:27:46 -0600
Subject: [PATCH 1/4] Update dependency-check

---
 .github/workflows/cron-job-its.yml | 4 ++--
 pom.xml                            | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/cron-job-its.yml b/.github/workflows/cron-job-its.yml
index 0e5717ea0df3..2e9575a2f4a0 100644
--- a/.github/workflows/cron-job-its.yml
+++ b/.github/workflows/cron-job-its.yml
@@ -116,9 +116,9 @@ jobs:
   security_vulnerabilities:
     if: github.repository == 'apache/druid'
     name: security vulnerabilities
-    strategy:
-      fail-fast: false
     runs-on: ubuntu-latest
+    env:
+      NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@v4
diff --git a/pom.xml b/pom.xml
index 70e2d89a2359..666e5765248e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1823,8 +1823,9 @@
             <plugin>
                 <groupId>org.owasp</groupId>
                 <artifactId>dependency-check-maven</artifactId>
-                <version>7.4.4</version>
+                <version>12.1.3</version>
                 <configuration>
+                    <nvdApiKeyEnvironmentVariable>NIST_NVD_API_KEY</nvdApiKeyEnvironmentVariable>
                     <failBuildOnCVSS>7</failBuildOnCVSS>
                     <skipProvidedScope>true</skipProvidedScope>
                     <skipSystemScope>true</skipSystemScope>  <!-- avoid error when processing jdk.tools:jdk.tools:jar:1.8:system -->

From 49ef49c74b03a9721efa08f09de18b7360e82bf4 Mon Sep 17 00:00:00 2001
From: Frank Chen <frank.chen021@outlook.com>
Date: Fri, 29 Aug 2025 16:47:58 +0800
Subject: [PATCH 2/4] Remove unused dependency

---
 extensions-contrib/ambari-metrics-emitter/pom.xml | 6 ------
 owasp-dependency-check-suppressions.xml           | 9 ---------
 pom.xml                                           | 5 -----
 3 files changed, 20 deletions(-)

diff --git a/extensions-contrib/ambari-metrics-emitter/pom.xml b/extensions-contrib/ambari-metrics-emitter/pom.xml
index 262169d1eed3..e34ac9daec64 100644
--- a/extensions-contrib/ambari-metrics-emitter/pom.xml
+++ b/extensions-contrib/ambari-metrics-emitter/pom.xml
@@ -125,12 +125,6 @@
       <version>${codehaus.jackson.version}</version>
       <scope>test</scope>
     </dependency>
-    <dependency>
-      <groupId>org.codehaus.jackson</groupId>
-      <artifactId>jackson-mapper-asl</artifactId>
-      <version>${codehaus.jackson.version}</version>
-      <scope>test</scope>
-    </dependency>
   </dependencies>
 
   <build>
diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index 6602fd02b11c..31e803d28643 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -231,15 +231,6 @@
     <cve>CVE-2023-0833</cve>  <!-- Suppressed since okhttp requests in Druid are internal, and not user-facing -->
   </suppress>
 
-  <suppress>
-    <!-- TODO: Fix by updating curator-x-discovery to > 4.2.0 and updating hadoop -->
-    <notes><![CDATA[
-   file name: jackson-mapper-asl-1.9.13.jar
-   ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@1.9.13$</packageUrl>
-    <cvssBelow>10</cvssBelow>  <!-- suppress all CVEs for jackson-mapper-asl:1.9.13 ince it is via curator-x-discovery -->
-  </suppress>
-
   <suppress>
     <!-- TODO: Fix by updating org.apache.druid.java.util.http.client.NettyHttpClient to use netty 4 -->
     <notes><![CDATA[
diff --git a/pom.xml b/pom.xml
index 2ebc64550466..e376485033ac 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1028,11 +1028,6 @@
                 <artifactId>jackson-core-asl</artifactId>
                 <version>${codehaus.jackson.version}</version>
             </dependency>
-            <dependency>
-                <groupId>org.codehaus.jackson</groupId>
-                <artifactId>jackson-mapper-asl</artifactId>
-                <version>${codehaus.jackson.version}</version>
-            </dependency>
             <dependency>
                 <groupId>javax.servlet</groupId>
                 <artifactId>javax.servlet-api</artifactId>

From f63e9178e58765684b4e305f25fa3e2df0d9b052 Mon Sep 17 00:00:00 2001
From: Frank Chen <frank.chen021@outlook.com>
Date: Fri, 5 Sep 2025 18:27:11 +0800
Subject: [PATCH 3/4] Update GHA

---
 .github/workflows/cron-job-its.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/cron-job-its.yml b/.github/workflows/cron-job-its.yml
index be1a4b7626a0..beecdc93c116 100644
--- a/.github/workflows/cron-job-its.yml
+++ b/.github/workflows/cron-job-its.yml
@@ -114,7 +114,7 @@ jobs:
       group: other
 
   security_vulnerabilities:
-    if: github.repository == 'apache/druid'
+    # if: github.repository == 'apache/druid'
     name: security vulnerabilities
     runs-on: ubuntu-latest
     env:
@@ -131,11 +131,11 @@ jobs:
           cache: maven
 
       - name: maven build # needed to rebuild in case of maven snapshot resolution fails
-        run: mvn clean install -P dist -P skip-static-checks,skip-tests -Dmaven.javadoc.skip=true -Dcyclonedx.skip=true -Dweb.console.skip=true
+        run: mvn clean install -P dist -P skip-static-checks,skip-tests -Dmaven.javadoc.skip=true -Dcyclonedx.skip=true -Dweb.console.skip=true -ntp
 
       - name: security vulnerabilities check
         run: |
-          mvn dependency-check:purge dependency-check:check || { echo "
+          mvn -ntp dependency-check:purge dependency-check:check --fail-at-end || { echo "
           The OWASP dependency check has found security vulnerabilities. Please use a newer version
           of the dependency that does not have vulnerabilities. To see a report run
           `mvn dependency-check:check`

From a4ab752e18dc96a860acc95d7a7f360de2349b83 Mon Sep 17 00:00:00 2001
From: Frank Chen <frank.chen021@outlook.com>
Date: Fri, 10 Oct 2025 11:17:47 +0800
Subject: [PATCH 4/4] Update env

---
 .github/workflows/cron-job-its.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cron-job-its.yml b/.github/workflows/cron-job-its.yml
index beecdc93c116..129ca66d1067 100644
--- a/.github/workflows/cron-job-its.yml
+++ b/.github/workflows/cron-job-its.yml
@@ -117,8 +117,6 @@ jobs:
     # if: github.repository == 'apache/druid'
     name: security vulnerabilities
     runs-on: ubuntu-latest
-    env:
-      NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@v4
@@ -134,6 +132,8 @@ jobs:
         run: mvn clean install -P dist -P skip-static-checks,skip-tests -Dmaven.javadoc.skip=true -Dcyclonedx.skip=true -Dweb.console.skip=true -ntp
 
       - name: security vulnerabilities check
+        env:
+          NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY }}
         run: |
           mvn -ntp dependency-check:purge dependency-check:check --fail-at-end || { echo "
           The OWASP dependency check has found security vulnerabilities. Please use a newer version