From 3a0a15c01c1d79821684173f2c8d72b65d39cab8 Mon Sep 17 00:00:00 2001
From: siddr <siddr@visa.com>
Date: Thu, 23 Jul 2026 12:28:46 +0530
Subject: [PATCH] [FLINK-38466] Bump derby from 10.15.2.0 to 10.17.1.0

Upgrades Apache Derby from 10.15.2.0 to 10.17.1.0 to address
CVE-2022-46337 (LDAP authentication bypass, CVSS 9.8).

Derby is used as a test-scoped embedded database in
flink-autoscaler-standalone and flink-autoscaler-plugin-jdbc.
It is not bundled in any release artifact, so no NOTICE update
is required per Apache legal guidelines.

Note: Derby 10.17.1.0 officially requires Java 21. CI pipelines
running these modules' tests may need to be updated accordingly.
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 04ac3cd246..5bd2f27f52 100644
--- a/pom.xml
+++ b/pom.xml
@@ -108,7 +108,7 @@ under the License.
 		     of entries in the form '[-]{2}add-[opens|exports]=<module>/<package>=ALL-UNNAMED'.-->
         <surefire.module.config/>
 
-        <derby.version>10.15.2.0</derby.version>
+        <derby.version>10.17.1.0</derby.version>
         <awaitility.version>4.2.2</awaitility.version>
 
         <!-- valid options can be checked at https://central.sonatype.com/search?q=kubernetes-httpclient- currently: okhttp, jdk, jetty, vertx -->