Fix critical security vulnerabilities: logback-core CVE-2025-11226 and KubernetesClient GHSA-w7r3-mgwf-4mqq

[Copilot]

Overview

This PR fixes all security vulnerabilities in the repository by updating vulnerable dependencies to their patched versions. Two vulnerabilities were identified and resolved:

1. CVE-2025-11226 (Critical): Arbitrary Code Execution in logback-core
2. GHSA-w7r3-mgwf-4mqq (Moderate): Certificate validation bypass in KubernetesClient

Vulnerability Details

1. CVE-2025-11226: logback-core ACE Vulnerability

Severity: Critical
Component: ch.qos.logback:logback-core (Maven dependency)
Issue: Versions up to 1.5.18 contain an arbitrary code execution vulnerability in conditional configuration file processing, allowing attackers to execute arbitrary code by compromising logback configuration files or injecting malicious environment variables.

Fix Applied:

<!-- FlinkIRRunner/pom.xml -->
- <version>1.5.15</version>
+ <version>1.5.20</version>

Updated both logback-classic and logback-core from 1.5.15 to 1.5.20 in FlinkIRRunner/pom.xml.

2. GHSA-w7r3-mgwf-4mqq: KubernetesClient Certificate Validation

Severity: Moderate
Component: KubernetesClient (transitive .NET dependency via Aspire)
Issue: KubernetesClient versions 15.0.1 and 16.0.7 accept certificates from any CA without properly verifying the trust chain, enabling man-in-the-middle attacks and API impersonation.

Fix Applied:
Updated Aspire packages from 9.3.1 to 9.5.1 across all solutions, which transitively updates KubernetesClient to the patched version 17.0.14:

• Aspire.Hosting.AppHost: 9.3.1 → 9.5.1
• Aspire.Hosting.Kafka: 9.3.1 → 9.5.1
• Aspire.Hosting.PostgreSQL: 9.3.1 → 9.5.1
• Aspire.Hosting.Redis: 9.3.1 → 9.5.1
• Aspire.Confluent.Kafka: 9.3.1 → 9.5.1
• Aspire.Hosting.Testing: 9.3.1 → 9.5.1

Also updated supporting dependencies to maintain compatibility:

• Microsoft.Extensions.Configuration: → 9.0.9
• Microsoft.Extensions.Configuration.Json: → 9.0.9
• Microsoft.Extensions.Configuration.EnvironmentVariables: → 9.0.9
• Confluent.Kafka: 2.11.0 → 2.11.1

Files Changed

• Maven (1 file): FlinkIRRunner/pom.xml
• .NET (9 files): Aspire-related projects in BackPressureExample, LocalTesting, and ReleasePackagesTesting solutions

Testing & Validation

✅ All builds passing: FlinkDotNet, BackPressureExample, LocalTesting
✅ All tests passing: No test failures, no regressions detected
✅ Security scans clean:

• dotnet list package --vulnerable --include-transitive: No vulnerabilities found
• mvn dependency:tree: All Maven dependencies secure
• GitHub Advisory Database: Both CVEs confirmed fixed

Verification

# Verify Maven dependencies are secure
cd FlinkIRRunner && mvn dependency:tree | grep logback
# [INFO] +- ch.qos.logback:logback-classic:jar:1.5.20:compile
# [INFO] \- ch.qos.logback:logback-core:jar:1.5.20:compile

# Verify .NET dependencies are secure
dotnet list package --vulnerable --include-transitive
# No vulnerabilities found in any project

# Verify KubernetesClient version
dotnet list package --include-transitive | grep KubernetesClient
# > KubernetesClient 17.0.14

Risk Assessment

Before: High risk with 1 critical and 1 moderate vulnerability
After: No known vulnerabilities - repository is secure

References

• CVE-2025-11226 - NVD
• GHSA-w7r3-mgwf-4mqq - GitHub Advisory
• Aspire 9.5.1 Release Notes

Original prompt

QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.

Please fix all security vulnerabilities in this entire repo and retests that nothing broken.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.