[PLUGIN-1918] [PLUGIN-1907] [PLUGIN-1904] CVE Fix for commons-lang3, logback-classic and org.json

Upgrade commons-lang3 from v3.8.1 to v3.18.0, logback-classic from v1.2.8 to v1.2.13 and org.json from v20180813 to v20231013

Author: sgarg-CS

pom.xml

@@ -65,15 +65,15 @@
     <hadoop.version>2.10.2</hadoop.version>
     <spark2.version>2.1.3</spark2.version>
     <hydrator.version>2.10.0</hydrator.version>
-    <commons.version>3.8.1</commons.version>
+    <commons.version>3.18.0</commons.version>
     <salesforce.api.version>53.0.0</salesforce.api.version>
     <cometd.java.client.version>4.0.0</cometd.java.client.version>
     <antlr.version>4.7.2</antlr.version>
     <mockito.version>2.23.0</mockito.version>
     <commons.csv.version>1.6</commons.csv.version>
     <jackson.version>1.9.13</jackson.version>
     <jackson2.version>2.17.1</jackson2.version>
-    <json.version>20180813</json.version>
+    <json.version>20231013</json.version>
     <awaitility.version>3.1.6</awaitility.version>
     <commons-logging.version>1.2</commons-logging.version>
     <testSourceLocation>${project.basedir}/src/test/java/</testSourceLocation>
@@ -94,7 +94,7 @@
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
-      <version>1.2.8</version>
+      <version>1.2.13</version>
     </dependency>
     <dependency>
       <groupId>io.cdap.cdap</groupId>

src/main/java/io/cdap/plugin/salesforce/plugin/source/streaming/SalesforceStreamingSourceUtil.java

@@ -33,6 +33,7 @@
 import org.slf4j.LoggerFactory;
 import scala.reflect.ClassTag$;
 
+import java.math.BigDecimal;
 import java.time.Instant;
 import java.time.LocalTime;
 import java.time.temporal.ChronoUnit;
@@ -147,6 +148,13 @@ private static Object convertValue(Object value, Schema.Field field) {
       }
     }
 
+    // NOTE: org.json >= 20230227 returns BigDecimal for all non-integer JSON numbers.
+    if (value instanceof BigDecimal && fieldSchemaType.equals(Schema.Type.DOUBLE)) {
+      // Avro Schema.Type.DOUBLE expects a Double instance (or primitive double) at serialization time,
+      // so converting BigDecimal → double for compatibility.
+      return ((BigDecimal) value).doubleValue();
+    }
+
     return value;
   }