[AUTO] Increment version to 2.19.4-SNAPSHOT

[opensearch-trigger-bot]

• Incremented version to 2.19.4-SNAPSHOT.

[dbwiddis]

Can we please try to get this merged? It's been open for 6 weeks and 2.19.4 Code Freeze is less than 3 weeks away.

[dhrubo-os]

I don't think job scheduler has merged their snapshot yet:

* What went wrong:
Could not determine the dependencies of task ':opensearch-ml-plugin:integTest'.
> Could not resolve all files for configuration ':opensearch-ml-plugin:zipArchive'.
   > Could not resolve org.opensearch.plugin:opensearch-job-scheduler:2.19.4.0-SNAPSHOT.
     Required by:
         project :opensearch-ml-plugin
      > Could not resolve org.opensearch.plugin:opensearch-job-scheduler:2.19.4.0-SNAPSHOT.
         > Unable to load Maven meta-data from https://ci.opensearch.org/ci/dbc/snapshots/lucene/org/opensearch/plugin/opensearch-job-scheduler/2.19.4.0-SNAPSHOT/maven-metadata.xml.
            > Could not GET 'https://ci.opensearch.org/ci/dbc/snapshots/lucene/org/opensearch/plugin/opensearch-job-scheduler/2.19.4.0-SNAPSHOT/maven-metadata.xml'. Received status code 403 from server: Forbidden
            

[gaiksaya]

@dhrubo-os Should be available now.

Looks like version bump is introducing a bunch of CVEs. Can someone follow up quickly and take a look?

Thanks!

[dbwiddis]

I don't think job scheduler has merged their snapshot yet

Yeah, as I was visiting other repos, discovered that Sonatype deletes snapshots after 30 days. Build team's working on longer term fix, and in the near term, JS snapshot just got re-published.

No urgency here, just trying to identify issues well in advance of release, and plugins at the bottom of the food chain haven't had a chance to test against any upstream changes (hopefully not breaking!).

[gaiksaya]

HI @dhrubo-os

Looks like integ-test are failing here after all the dependencies being available. Can someone look into it and also address the CVEs that mend/whitsource is showing here?

Thanks!

[brianf-aws]

Taking a look the change I have isnt the cleanest since the netty jars were changed a lot in this commit,

5883f54

[dbwiddis]

Can someone look into it and also address the CVEs that mend/whitsource is showing here?

@gaiksaya most of the CVE issues are coming from core. I've got PRs open or merged to address all of them.

We should, in general, encourage plugins to use the version catalog and then make sure we keep that up to date (usually not an issue on main but the 2.19 branch tends to lag as we no longer regularly backport dependency bumps).