[LIVY-1077] Bump jetty.version to latest 9.4.x (9.4.58.v20250814)

[soumyadeeplogin]

What changes were proposed in this pull request?

Bumps jetty.version in pom.xml from 9.4.56.v20240826 to 9.4.58.v20250814 -- the latest version actually published on the Jetty 9.4.x branch.

The current jetty-http/jetty-server/jetty-security version is affected by CVE-2026-2332 / GHSA-355h-qmc2-wpwf -- an HTTP/1.1 request smuggling issue via malformed chunk-extension quoted-string parsing in Jetty's chunked transfer-encoding parser (CVSS 7.4 High, CWE-444).

Checked against the advisory (OSV) and Maven Central directly: the actual fix for this CVE on the 9.4.x branch is version 9.4.60, but 9.4.59/9.4.60 have never been published to Maven Central -- the upstream advisory itself still reads "No patches yet" for that branch as of this writing. The only published fixes are on Jetty 10.x/11.x/12.x, all of which require Java 11+ (12.x requires Java 17+ and moves javax.servlet -> jakarta.servlet) -- a real migration, not a version-property bump, and out of scope for this PR.

This bumps to the latest available 9.4.x release as defense-in-depth, picking up every other 9.4.x security fix since 9.4.56. CVE-2026-2332 itself remains open against jetty-http pending an upstream Jetty 9.4.x patch release, or a separately-scoped move to Jetty 10+/Java 11+.

How was this patch tested?

mvn dependency:tree resolves cleanly to 9.4.58.v20250814 across every module that pulls in jetty.version (server, assembly, client-http, thriftserver), with no dependency conflicts. mvn compile on those modules succeeds with no errors. This is a version-property change only, no code paths are touched, so no new unit tests are needed.

Was this patch authored or co-authored using generative AI tooling?

Yes. Generated-by: Claude Code (Sonnet 5, Anthropic), used to research the CVE against Maven Central/OSV/GHSA data, draft this change, and file the companion JIRA ticket, under human review. Please refer to the ASF Generative Tooling Guidance for details.

Note on JIRA

Filed as LIVY-1077.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.83%. Comparing base (501e822) to head (b1f5c8e).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #551      +/-   ##
============================================
+ Coverage     68.68%   68.83%   +0.14%     
- Complexity     1218     1219       +1     
============================================
  Files           106      107       +1     
  Lines          6815     6873      +58     
  Branches        836      839       +3     
============================================
+ Hits           4681     4731      +50     
- Misses         1666     1674       +8     
  Partials        468      468              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gyogal]

Thank you for your PR @soumyadeeplogin ! As mentioned in #480 , Jetty 9.4 is the last version compatible with Java 8, thus we are stuck with it as long as we want to retain Java 8 / Spark 3.5 support. It is still good to have the latest publicly available version though, so once again thanks for opening a PR for it.