fix(security): bump micrometer to 1.16.7 for CVE-2026-59296 (2.0)

[sonika-shah]

What

Direct-to-2.0 companion of #31926. Bump micrometer 1.15.12 → 1.16.7 to remediate CVE-2026-59296, and bump prometheus-metrics-instrumentation-dropwizard 1.3.10 → 1.4.3 in lockstep to keep the prometheus client_java family aligned.

Raised directly against 2.0 (rather than relying on a cherry-pick of #31926) because this is a two-hunk pom change and the release is imminent — landing only one hunk on 2.0 would leave the prometheus-metrics family split and cause a runtime NoSuchMethodError.

Why

micrometer-core 1.15.12 is flagged by CVE-2026-59296 — metric/log line injection via unsanitized newlines in the StatsD and Logging registries (CWE-74, CVSS 5.9 MEDIUM). The 1.15.x line has no OSS fix (1.15.13 is enterprise-only), so the minimum OSS remediation is 1.16.7.

micrometer-registry-prometheus 1.16.x pulls the prometheus client_java family at 1.4.3 (up from 1.3.10); the prometheus-metrics-instrumentation-dropwizard pin keeps that whole family on one version, so it moves to 1.4.3 too.

Validation (against the 2.0 release commit)

• dependency:tree: entire micrometer-* family 1.16.7; entire prometheus-metrics-* family uniformly 1.4.3 — no split. (io.prometheus:simpleclient 0.16.0 is a separate library and is untouched.)
• Compile + install of openmetadata-service: BUILD SUCCESS. OM uses only stable core micrometer APIs and has zero direct io.prometheus.metrics.* imports (only one module even consumes the artifact), so the 1.4.3 jump is purely transitive.
• Runtime scrape smoke test mirroring MicrometerBundle (PrometheusMeterRegistry(DEFAULT) + JVM/system binders + counter/timer → .scrape()): valid Prometheus exposition, no NoSuchMethodError.

Scope

Two version lines in the root pom.xml. Metrics stack only. StatsD / LoggingMeterRegistry (the affected registries) are not used by OpenMetadata — only micrometer-registry-prometheus — so the vulnerable path is not reachable in practice; this clears the scanner finding.

Greptile Summary

This PR upgrades Micrometer to 1.16.7 to remediate CVE-2026-59296 while aligning the Prometheus client family.

• Updates the centrally inherited Micrometer version from 1.15.12 to 1.16.7.
• Updates prometheus-metrics-instrumentation-dropwizard from 1.3.10 to 1.4.3 to match Micrometer’s Prometheus dependencies.
• Documents why the Prometheus family must remain version-aligned.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
pom.xml	Aligns the centrally managed Micrometer and Prometheus dependency versions; no blocking issue was identified.

_{Reviews (2): Last reviewed commit: "Merge branch '2.0' into sec/micrometer-c..." | Re-trigger Greptile}

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

Bumps micrometer to 1.16.7 and prometheus-metrics-instrumentation-dropwizard to 1.4.3 in the root pom.xml to remediate CVE-2026-59296. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[github-actions]

✅ Playwright Results — workflow succeeded

Validated commit 8c5f249028835f07bc06886f4e7bcb92d4120155 in Playwright run 32686985626, attempt 1.

✅ 551 passed · ❌ 0 failed · 🟡 0 flaky · ⏭️ 0 skipped · 🧰 0 lifecycle flaky

Performance

Blocking targets: ✅ met · Optimization targets: 🟡 in progress

Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting.

🕒 Full workflow signal wall (to summary) 50m 4s

⏱️ Max setup 3m 1s · max shard execution 17m 50s · max shard-job elapsed before upload 21m 34s · reporting 4s

🌐 210.26 requests/attempt · 2.83 app boots/UI scenario · 4.39% common-shard skew

Optimization targets still in progress:

• Browser traffic was 210.26 requests per attempt (convergence target: fewer than 200).
• Application boot ratio was 2.83 per UI scenario (1619 boots / 572 scenarios; convergence target: at most 1).

Shard	Passed	Failed	Flaky	Skipped	Lifecycle failed	Lifecycle flaky
✅ Shard chromium-01	138	0	0	0	0	0
✅ Shard chromium-02	135	0	0	0	0	0
✅ Shard chromium-03	126	0	0	0	0	0
✅ Shard data-asset-rules-01	61	0	0	0	0	0
✅ Shard domain-isolation-01	14	0	0	0	0	0
✅ Shard global-state-01	34	0	0	0	0	0
✅ Shard ingestion-01	1	0	0	0	0	0
✅ Shard reindex-01	2	0	0	0	0	0
✅ Shard search-01	11	0	0	0	0	0
✅ Shard search-rbac-01	29	0	0	0	0	0

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

[github-actions]

The Java checkstyle failed.

Please run mvn spotless:apply in the root of your repository and commit the changes to this PR.
You can also use pre-commit to automate the Java code formatting.

You can install the pre-commit hooks with make install_test precommit_install.