This is an automated email from the ASF dual-hosted git repository.
CalvinKirs pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 73be0147c96 [fix](fe) Upgrade Nimbus dependencies (#67065)
73be0147c96 is described below
commit 73be0147c96783edd3d0d6e18a1e8ea75b3ffb4f
Author: Calvin Kirs <[email protected]>
AuthorDate: Fri Sep 11 14:43:53 2026 +0800
[fix](fe) Upgrade Nimbus dependencies (#67065)
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary: FE resolves `grpc-netty-shaded` 1.65.1 and Nimbus
JOSE+JWT 10.0.1, which are affected by CVE-2025-55163 and
CVE-2025-53864. Upgrade the managed gRPC BOM to 1.75.0 and Nimbus
JOSE+JWT to 10.0.2 so all FE consumers resolve security-fixed versions.
---
fe/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fe/pom.xml b/fe/pom.xml
index bf3ecb76242..593653f1052 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -458,7 +458,7 @@ under the License.
<maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
<argLine></argLine>
<trino.version>435</trino.version>
- <nimbusds.version>10.0.1</nimbusds.version>
+ <nimbusds.version>10.0.2</nimbusds.version>
<jakarta.annotation-api.version>2.1.1</jakarta.annotation-api.version>
<asm.version>9.4</asm.version>
<airlift.concurrent.version>202</airlift.concurrent.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
