[FLINK-40243] Bump JDBC test dependencies: derby 10.15.2.0→10.17.1.0, postgresql 42.5.6→42.7.13

[r-sidd]

What is the purpose of the change

Bump derby and postgresql JDBC driver versions to address known CVEs. Both dependencies are declared <scope>test</scope> in flink-autoscaler-standalone and/or flink-autoscaler-plugin-jdbc and are not bundled in any release artifact.

Brief change log

Derby (pom.xml):

• CVE-2022-46337 — LDAP authentication bypass (CVSS 9.8)
• Current: Maven Repository: org.apache.derby » derby » 10.15.2.0
• Latest: Maven Repository: org.apache.derby » derby » 10.17.1.0

PostgreSQL JDBC driver (flink-autoscaler-plugin-jdbc/pom.xml):

• CVE-2026-42198 — SCRAM-SHA-256 iteration-count DoS (CVSS 7.5 HIGH)
• Current: Maven Repository: org.postgresql » postgresql » 42.5.6
• Latest: Maven Repository: org.postgresql » postgresql » 42.7.13

Verifying this change

This change is a trivial rework / code cleanup without any test coverage.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): yes
• The public API, i.e., is any changes to the CustomResourceDescriptors: no
• Core observer or reconciler logic that is regularly executed: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable

[Dennis-Mircea]

This is the second CVE-driven bump in the flink-autoscaler-plugin-jdbc dependency family, after #1165 (derby). Rather than one PR/JIRA per driver, it would be cleaner to consolidate the JDBC plugin's database dependency bumps into a single PR (and ideally a single JIRA), so the whole family is reviewed and CI-validated together.

While at it, worth checking the rest of the same umbrella for available updates / advisories in the same pass.

postgresql and derby are both <scope>test</scope> here, so these are test/CI dependencies rather than shipped artifacts, which is worth stating in the JIRA so the security severity is scoped correctly.

[r-sidd]

This is the second CVE-driven bump in the flink-autoscaler-plugin-jdbc dependency family, after #1165 (derby). Rather than one PR/JIRA per driver, it would be cleaner to consolidate the JDBC plugin's database dependency bumps into a single PR (and ideally a single JIRA), so the whole family is reviewed and CI-validated together.

While at it, worth checking the rest of the same umbrella for available updates / advisories in the same pass.

postgresql and derby are both <scope>test</scope> here, so these are test/CI dependencies rather than shipped artifacts, which is worth stating in the JIRA so the security severity is scoped correctly.

Thanks @Dennis-Mircea - will consolidate the derby bump (#1165) into this PR so both are reviewed and CI-validated together under a single changeset. Checked the remaining deps - no CVEs so no updates needed there.

Will update this PR shortly.

[mbalassi]

Thanks @r-sidd and @Dennis-Mircea, triggered CI.

[mbalassi]

@r-sidd this CI error seems to be related:
https://github.com/apache/flink-kubernetes-operator/actions/runs/30466098209/job/90940108424?pr=1167#step:4:66833

[r-sidd]

@r-sidd this CI error seems to be related: https://github.com/apache/flink-kubernetes-operator/actions/runs/30466098209/job/90940108424?pr=1167#step:4:66833

Let me check and fix this.