Uber jar bundles commons-lang3 3.14.0 instead of 3.18.0 (CVE-2025-48924)

[o-shevchenko]

Problem

The dependencyManagement override for commons-lang3 was only defined in jdbc-core/pom.xml, not in the parent pom. Since the uber jar module (assembly-uber) inherits from the parent pom (not from jdbc-core), the transitive dependency from commons-configuration2 resolves to commons-lang3:3.14.0 instead of the intended 3.18.0.

This means the released databricks-jdbc-3.3.1.jar (uber jar) bundles the vulnerable commons-lang3:3.14.0 despite the changelog stating it was updated.

Impact

• CVE-2025-48924 (MEDIUM) remains present in the uber jar
• Vulnerability scanners (e.g., Trivy) correctly flag the bundled 3.14.0 version

Fix

Move the dependencyManagement section from jdbc-core/pom.xml to the parent pom.xml so all modules (including assembly-uber and assembly-thin) resolve commons-lang3 to 3.18.0.

[o-shevchenko]

@vikrantpuppala Could you please review this?
Can we ensure it will be added to the next release as well?

[github-actions]

This issue has been marked as Stale because it has been open for 30 days with no activity. If you would like the issue to remain open, please remove the stale label or comment on the issue.

[github-actions]

This issue was closed because it has been inactive for 7 days since being marked as stale.

[samikshya-db]

Looks like this was closed as part of the above PR. Thanks for the contribution !