apicurio-registry/3.0.6-r1: cve remediation

[octo-sts]

apicurio-registry/3.0.6-r1: fix GHSA-gfh6-3pqw-x2j4

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/apicurio-registry.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error: WARNING: An aggregator mojo is already being executed in this parallel build

• Error Category: Build Configuration

• Failure Point: Maven parallel build execution with non-thread-safe plugins

• Root Cause Analysis: The build is using parallel execution (-T flag) but contains plugins that are not marked as thread-safe, specifically the apicurio-registry-maven-plugin. This is causing conflicts during the build process.

• Suggested Fix: Modify the build command to remove parallel execution by removing the -T$(nproc)C flag:

  - name: Build
    runs: |
      # fixes xml prior to install. previously formatting had issues.
      mvn spotless:apply
      ./mvnw clean install \
        -Pprod \
        -DskipTests \
        --no-snapshot-updates \
        --no-transfer-progress \
        --fail-fast

• Explanation: By removing parallel execution:

1. All plugins will run sequentially, avoiding thread-safety issues
2. The build will be more stable and predictable
3. The aggregator mojo warning will be resolved
4. While build time may increase slightly, it ensures reliable builds

• Additional Notes:

• The parallel build issue specifically affects the apicurio-registry-maven-plugin:3.0.6
• Consider filing an upstream issue to make the plugin thread-safe
• If build time is critical, you could investigate updating to newer versions of the plugin that may be thread-safe

• References:

• Maven Parallel Builds: https://maven.apache.org/guides/mini/guide-parallel-builds.html
• Thread Safety in Maven Plugins: https://maven.apache.org/developers/conventions/code.html#thread-safety