[Snyk] Fix for 2 vulnerabilities

[snyk-io]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• debezium-server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598	255	software.amazon.awssdk:kinesis: 2.13.13 -> 2.17.295 No Path Found Proof of Concept
	Incomplete List of Disallowed Inputs SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366	182	software.amazon.awssdk:kinesis: 2.13.13 -> 2.17.295 No Path Found No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade io.debezium:debezium-embedded@1.2.0-SNAPSHOT to io.debezium:debezium-embedded@3.5.0.Final; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[snyk-io]

This upgrade includes a high-risk major version jump for Debezium and a low-risk minor update for the AWS SDK.

io.debezium:debezium-embedded@1.2.0-SNAPSHOT → 3.5.0.Final

Risk: HIGH

This is a major upgrade from a very old version to a modern one, crossing the significant Debezium 2.0 boundary which introduced substantial breaking changes. Direct migration will require code and configuration changes.

Key Breaking Changes (from 1.x to 2.x):

• Java 11 Required: Support for Java 8 was dropped in Debezium 2.x; a Java 11 runtime is now required. [14]
• Configuration Properties Renamed: Many configuration properties have been renamed. For example, database.server.name is now topic.prefix, and the database.history.* prefix is now schema.history.internal.*. All configurations must be reviewed and updated. [3]
• Change Event Structure: The format of the change data capture events has changed. Notably, a before field has been added to the record schema to include the state of the row before the event occurred. Downstream consumers may need to be adapted to this new structure. [3]
• Default Behavior Changes: Defaults for properties like schema.name.adjustment.mode and database SSL connections have changed, which could alter behavior without explicit configuration updates. [3]

Note on Version 3.5.0.Final: While Maven Central lists version 3.5.0.Final, official release notes detailing changes beyond the 2.x series were not found. [2, 7] The risk assessment is based on the well-documented breaking changes introduced in version 2.0.

Recommendation: A direct upgrade in a production environment is not recommended. A thorough migration plan is necessary to address the required changes in runtime environment, application configuration, and any code that consumes Debezium events.

software.amazon.awssdk:kinesis@2.13.13 → 2.17.295

Risk: LOW

This is a minor version upgrade within the AWS SDK for Java v2. No breaking API changes for the Kinesis client are documented in the official changelogs for this version range. [6] The upgrade primarily consists of feature additions, security patches, and bug fixes. A notable improvement in this timeframe is that the Kinesis Producer Library (KPL) was updated to support the AWS SDK for Java v2, removing the dependency on the v1 SDK. [10, 16]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.