[Snyk] Fix for 1 vulnerabilities

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• debezium-server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	169	software.amazon.awssdk:kinesis: 2.13.13 -> 2.17.295 Major version upgrade No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade io.debezium:debezium-embedded@1.2.0-SNAPSHOT to io.debezium:debezium-embedded@3.5.0.Final; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location
• Could not upgrade io.quarkus:quarkus-smallrye-health@1.4.1.Final to io.quarkus:quarkus-smallrye-health@2.3.0.Final; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[snyk-io]

This upgrade includes multiple major version jumps with significant breaking changes, particularly in Debezium and Quarkus, requiring careful migration and testing.

Top 3 Impactful Upgrades

• io.debezium:debezium-embedded 1.2.0-SNAPSHOT → 3.5.0.Final (High Risk)
  This is a multi-major version upgrade crossing both 2.x and 3.x releases, introducing substantial breaking changes. Key changes include a mandatory Java runtime update to Java 17 for connectors [1, 5], extensive renaming of configuration properties (e.g., database.server.name to topic.prefix) [2], changes in default behaviors like SSL connections [2], and modifications to the change event structure [2]. Migrating from a SNAPSHOT version adds further risk. A full review of the Debezium 2.0 and 3.0 migration guides is required.

  • Recommendation: This upgrade must be handled as a separate, dedicated migration effort. Expect to update configurations, application code that processes Debezium events, and the underlying Java runtime environment.
  • Source: Debezium 2.0 Breaking Changes, Debezium 3.0 Release Notes

• io.quarkus:quarkus-smallrye-health 1.4.1.Final → 2.3.0.Final (High Risk)
  This upgrade crosses a major version boundary from Quarkus 1.x to 2.x. The Quarkus 2.0 release is built on Vert.x 4 and MicroProfile 4, which introduces significant changes. [4] Key breaking changes include a new class loading model for testing, a switch to a centralized Jackson Mapper for JSON configuration [3], and the renaming of annotations like @GrpcService to @GrpcClient [3]. The working directory for development mode also changed in version 2.3. [13]

  • Recommendation: Follow the official Quarkus 2.0 migration guide carefully. [3

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.