CC-41520: bump commons-configuration2 to 2.15.0 (CVE-2026-45205)

[Sahil Sonawane (saheeeel)]

Problem

CC-41520 flags org.apache.commons:commons-configuration2:2.10.1 — CVE-2026-45205 (MEDIUM): Apache Commons Configuration uncontrolled recursion → StackOverflowError on cyclic YAML input (affects 2.2 before 2.15.0), fixed in 2.15.0. Impacted kafka-connect-s3 versions: 10.6.15–10.6.17, 11.0.13–11.0.16, 12.1.5–12.1.8.

commons-configuration2 is pulled transitively via the Hadoop stack, and its version is forced by this repo's root pom <dependencyManagement> (hardcoded 2.10.1) — so a single managed bump remediates the packaged kafka-connect-s3 artifact.

Solution

Bump the managed commons-configuration2 version 2.10.1 → 2.15.0 in the root pom <dependencyManagement>. 2.15.0 is the fixed version per the advisory and is a backward-compatible upgrade on the 2.x line.

Does this solution apply anywhere else?

• yes
• no

If yes, where?

Forward-merges from 10.6.x to 11.0.x / 12.0.x / 12.1.x (and up) via pint.

Test Strategy

• Resolved graph: commons-configuration2:2.15.0 (compile) in kafka-connect-s3.
• Trivy (before): packaged lib/ bundled commons-configuration2-2.10.1.jar → CVE-2026-45205 flagged.
• Trivy (after): lib/ bundles commons-configuration2-2.15.0.jar; CVE-2026-45205 no longer reported (only an unrelated MEDIUM remains).

  trivy --skip-files "*.zip" rootfs --scanners vuln --severity CRITICAL,HIGH,MEDIUM,LOW target/components/packages
  

• Unit tests: 248 run / 247 pass / 1 flaky failure (Temurin 11). The single failure is S3SinkConnectorFaultyS3Test.testErrorIsRetriedByConnectFramework — a timing-sensitive fault-injection/retry test (60s timeout, ~70 repeats: "Files not written to S3 bucket in time") that flaked under local build load. It is unrelated to the commons-configuration2 bump (a Hadoop config-parsing library with no path to S3 write-retry timing); CI runs it in a clean environment.
• Integration / KDP: the S3-sink IT and s3-sink.sh KDP require live AWS credentials + an S3 bucket — run in CI. commons-configuration2 is a transitive, backward-compatible patch (Hadoop config parsing), so no connector code path changes.

Testing done:

• Unit tests
• Integration tests
• System tests
• Manual tests

Release Plan

Merge to 10.6.x; pint forward-merges to 11.0.x / 12.x. Cut new kafka-connect-s3 releases. Build-only change (one managed version) — safe to roll back.

---

Validation update — CI, KDP, dependency tree (2026-07-22)

CI (Semaphore) — ✅ PASS (after re-run: pipeline a24973fe).

• The initial run failed on a transient Maven dependency-resolution race — java.util.ConcurrentModificationException while collecting io.confluent:kafka-connect-protobuf-converter:[7.7.8-0,7.7.9-0) in the kafka-connect-s3 child module. This is unrelated to the commons-configuration2 bump (the parent module built SUCCESS; no test ran). Re-triggering the workflow produced a clean green build.
• Connector Kafka Docker Playground (KDP) block: ✅ PASSED (job 0524cb8c) — KDP ran on this PR commit 37e05ba with the commons-configuration2 bump included (it passed even on the initial pipeline, since it runs independently of the unit-Test block).

Dependency tree (after — resolved graph):

\- org.apache.commons:commons-configuration2:jar:2.15.0:compile

Resolved to commons-configuration2 → 2.15.0 (CC-41520 / CVE-2026-45205) across the kafka-connect-s3 modules.

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[sonarqube-confluent]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube