Hi,

there's nothing wrong with using older versions of dependencies (implying there are no known security vulnerabilities, which is true for 1.19). On the other hand, bumping dependency version may require additional testing overhead, because sometimes even minor bumps can cause some bugs/problems/instabilities.
Considering these facts, I'm closing this since there's no need in bumping this dependency so far. Discussed in #1083, that's a transitive dependency.
bump apache-commons-compress from 1.19 to 1.21 in kafka-ui-api
Current version in use is almost two years old.

https://mvnrepository.com/artifact/org.apache.commons/commons-compress
pom.xml
pom.xml
diff --git a/pom.xml b/pom.xml
index 44ee572a213..cb5bf344660 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,7 @@
         <openapi-generator-maven-plugin.version>4.3.0</openapi-generator-maven-plugin.version>
         <swagger-annotations.version>1.6.0</swagger-annotations.version>
         <springdoc-openapi-webflux-ui.version>1.2.32</springdoc-openapi-webflux-ui.version>
-        <avro.version>1.9.2</avro.version>
+        <avro.version>1.11.0</avro.version>
         <confluent.version>5.5.1</confluent.version>
         <apache.commons.version>2.2</apache.commons.version>
         <test.containers.version>1.16.2</test.containers.version>
