[jennedebleser]

Pin com.aayushatharva.brotli4j (brotli4j, plus the linux/osx/windows x86_64 and aarch64 natives) to 1.24.0 in timefold-solver-service-parent. Quarkus BOM 3.40.1 manages 1.23.0, which Aikido flags (AIKIDO-2026-717109, AIKIDO-2026-27936).

timefold-solver-service-parent has no parent. Its own dependencyManagement governs every model service, so the pin goes there. The solver library is not affected.

mvn -Ptest-model -pl service/test-model dependency:tree -Dincludes=com.aayushatharva.brotli4j

Before:

\- com.aayushatharva.brotli4j:brotli4j:jar:1.23.0:compile
   +- com.aayushatharva.brotli4j:service:jar:1.23.0:compile
   \- com.aayushatharva.brotli4j:native-osx-aarch64:jar:1.23.0:compile

After:

\- com.aayushatharva.brotli4j:brotli4j:jar:1.24.0:compile
   +- com.aayushatharva.brotli4j:service:jar:1.24.0:compile
   \- com.aayushatharva.brotli4j:native-osx-aarch64:jar:1.24.0:compile

Not verified: the linux natives do not appear in the tree on macOS. help:effective-pom shows them managed at 1.24.0.

[Copilot]

🟢 Approval recommended

The dependency overrides are consistent, correctly scoped to service models, and have no identified blocking issues.

No open issues 🎉

What changed in this PR

Pins Brotli4j to 1.24.0 in the standalone service parent to address the reported security alerts. The override applies to model services, not the solver library.

Changes:

• Adds a shared Brotli4j version property.
• Overrides the Quarkus BOM version for Brotli4j and five Linux, macOS, and Windows native artifacts.

File	Description
service/​facade/​service-parent/​pom.xml	Manages Brotli4j and selected native artifacts at version 1.24.0.

_{Review effort: Balanced}

[Christopher-Chianelli]

Windows build fails due to unrelated issue. LGTM (although I would maybe add a TODO to remove the overrides when Quarkus updates the version).

[Copilot]

🟢 Approval recommended

The overrides use Maven dependency management correctly, share one version property, and remain scoped to model services.

No open issues 🎉

_{Review effort: Balanced}

[rsynek]

OK to merge if there are no other ways of securing the solver-service, e.g. by disabling the decompression algorithm.