[Snyk] Security upgrade org.eclipse.jetty:jetty-server from 11.0.14 to 12.0.38

[benjaminhuo]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• functions-framework-invoker/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	HTTP Request Smuggling SNYK-JAVA-ORGECLIPSEJETTY-19644207	726	org.eclipse.jetty:jetty-server: 11.0.14 -> 12.0.38 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[benjaminhuo]

The upgrade from Jetty 11.0.14 to 12.0.38 is a major version jump with extensive breaking changes. Jetty 12 introduces a fundamental architectural overhaul, requiring significant migration effort.

Key Breaking Changes:

• Java Version Requirement: Jetty 12 requires Java 17, an increase from Java 11 required by Jetty 11.
• Core API Redesign: The server-side APIs have been completely redesigned. Jetty 12's core is now independent of the Servlet API and is based solely on its own Handler APIs. Applications built directly on Jetty's APIs will need substantial refactoring.
  • The Handler interface and its request processing model have changed. The handle method signature is different, and handlers now return true to indicate a request was handled instead of calling Request.setHandled(true).
  • The Request object is now immutable.
  • Classes like HandlerCollection and HandlerList have been replaced by Handler.Sequence.
• Module System Changes: To support applications using Servlet APIs, you must now use specific "EE Environment" modules (e.g., ee10-servlet, ee10-deploy). The standard modules no longer include Servlet functionality. For example, the deploy module from Jetty 11 must be explicitly changed to an ee- prefixed version to deploy standard web applications.
• Package and Class Renaming: Several classes have been renamed or replaced, such as WriteCallback becoming Callback.

Source: Migrating from Jetty 11 to 12

Recommendation: This is a complex migration that requires careful planning and significant code and configuration updates. Developers must follow the official migration guide closely. A simple version bump will not work and will lead to compilation and runtime failures.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}