I just want to add that there is a Spark Jira issue[1] for upgrading Netty
once Arrow v13.0.0 is released this month.
[1] https://issues.apache.org/jira/projects/SPARK/issues/SPARK-44212
On Thu, Jul 6, 2023 at 2:25 PM Dane Pitkin wrote:
> Hi all,
>
> The next release of Apache Arrow v13.0.0 coming this month[1] has upgraded
> Netty to v4.1.94.Final[2] due to a moderate severity CVE[3]. We are seeing
> that Spark using Netty v4.1.93.Final is not compatible with Arrow
> v13.0.0, throwing an exception at runtime[4]. There has been some talk in a
> Spark PR about upgrading to Netty v4.1.94.Final once the new
> arrow-memory-netty is released[5].
>
> Should the Spark POM be updated to shade arrow-memory-netty?
>
> Thanks,
> Dane
>
> [1] https://lists.apache.org/thread/f9r0dsd65ohdtcvc7fnnlfs23n3z0n7f
> [2] https://github.com/apache/arrow/pull/36211
> [3] https://github.com/advisories/GHSA-6mjq-h674-j845
> [4] https://github.com/apache/arrow/issues/36332
> [5] https://github.com/apache/spark/pull/41681
>
>
