apache-pulsar/4.0.6-r0: cve remediation

[octo-sts]

apache-pulsar/4.0.6-r0: fix GHSA-prj3-ccx8-p6x4

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/apache-pulsar.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

📦 Build Failed: Missing Dependency

package io.netty.buffer does not exist

Build Details

Category	Details
Build System	Maven
Failure Point	maven-compiler-plugin:3.11.0:compile (default-compile) on project java-test-plugins

Root Cause Analysis 🔍

The Netty dependencies (io.netty.buffer, io.netty.channel, io.netty.channel.socket) are missing from the classpath during compilation. Multiple Java source files are trying to import Netty classes but the required Netty libraries are not available as dependencies in the Maven project configuration.

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[jamie-albert]

• malcontent scans are clean

jamie.albert@Mac presub-scan % ./presub-scan.sh https://apk.cgr.dev/wolfi-presubmit/162f953e63ba1c8d90133eba71904ea30947c31b
Output root: presub-scan_20250814_185637
Choose scan type [malcontent/cve/both]: malcontent
Beginning scan (resumable).

=== PHASE 1: DOWNLOADING PACKAGES ===
→ Processing x86_64 packages...
   → Found        2 packages to download
   → Downloading (2/2): apache-pulsar-4.0.6-r1.apk
   ✔ Downloaded        2 packages for x86_64
→ Processing aarch64 packages...
   → Found        2 packages to download
   → Downloading (2/2): apache-pulsar-4.0.6-r1.apk
   ✔ Downloaded        2 packages for aarch64

=== PHASE 2: SCANNING PACKAGES ===
→ Scanning x86_64 packages...
   → Malcontent results → presub-scan_20250814_185637/malcontent/x86_64/mal_scan_apache-pulsar-compat-4.0.6-r1.apk_20250814_185637.txt
   → Scanning (2/2): apache-pulsar-4.0.6-r1.apk
   ✔ Scanned        2 packages for x86_64
→ Scanning aarch64 packages...
   → Malcontent results → presub-scan_20250814_185637/malcontent/aarch64/mal_scan_apache-pulsar-compat-4.0.6-r1.apk_20250814_185637.txt
   → Scanning (2/2): apache-pulsar-4.0.6-r1.apk
   ✔ Scanned        2 packages for aarch64
All done.

Summary:
  • malcontent scans are clean

Check output under: presub-scan_20250814_185637