[Snyk] Fix for 14 vulnerabilities

[BewareMyPower]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • pom.xml

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Upgrade	Breaking Change	Exploit Maturity
	379/1000 Why? Has a fix available, CVSS 3.3	Creation of Temporary File in Directory with Insecure Permissions SNYK-JAVA-COMGOOGLEGUAVA-5710356	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	638/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 4.9	Resource Exhaustion SNYK-JAVA-COMRABBITMQ-6028124	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	Proof of Concept
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JAVA-COMSQUAREUPOKIO-5773320		No	Proof of Concept
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JAVA-COMSQUAREUPOKIO-5820002	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	Proof of Concept
	490/1000 Why? Has a fix available, CVSS 5.3	Improper Certificate Validation SNYK-JAVA-IONETTY-1042268	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Improper Input Validation SNYK-JAVA-ORGAPACHEAVRO-5926693	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Denial of Service (DoS) SNYK-JAVA-ORGAPACHECOMMONS-1316638	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Denial of Service (DoS) SNYK-JAVA-ORGAPACHECOMMONS-1316639	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Denial of Service (DoS) SNYK-JAVA-ORGAPACHECOMMONS-1316640	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JAVA-ORGAPACHECOMMONS-1316641	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	No Known Exploit
	486/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.3	Information Exposure SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Allocation of Resources Without Limits or Throttling SNYK-JAVA-ORGJSON-5962464		No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Allocation of Resources Without Limits or Throttling SNYK-JAVA-ORGXERIALSNAPPY-5918282	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	Proof of Concept
	651/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.6	Arbitrary Code Execution SNYK-JAVA-ORGYAML-3152153	io.streamnative:pulsar-broker: 3.0.0.1 -> 3.1.0.5	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade io.streamnative.pulsar.handlers:[email protected] to io.streamnative.pulsar.handlers:[email protected]; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Creation of Temporary File in Directory with Insecure Permissions
🦉 Resource Exhaustion
🦉 Improper Input Validation
🦉 More lessons are available in Snyk Learn

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

@BewareMyPower:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)