CalvinKirs commented on PR #70249: URL: https://github.com/apache/doris/pull/70249#issuecomment-6654232999
Dependency review of `39bc832e8e447e295bf817928e64d4aef054fe43` (license compatibility, known CVEs and dependency management only). **License compatibility: OK for the newly introduced components.** The MongoDB client drivers use Apache-2.0; the bundled permissive licenses are compatible. The MongoDB Server's SSPL does not apply to these client dependencies. **Please update these two dependency versions before merging:** 1. **MongoDB C Driver/libbson: 2.5.7 → 2.5.8.** The new pin in [thirdparty/vars.sh](https://github.com/apache/doris/blob/39bc832e8e447e295bf817928e64d4aef054fe43/thirdparty/vars.sh#L232-L235) falls within the affected ranges for **CVE-2026-120956, CVE-2026-120678, CVE-2026-120955 and CVE-2026-120684**. These cover cursor-response handling, compressed-response memory leaks and GridFS-specific issues. The [official 2.5.8 release](https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.8), available since November 3, fixes them. Update the URL, archive/source names, checksum and distribution version metadata together. 2. **snappy-java: 1.1.10.5 → at least 1.1.10.10.** The new [MongoDB runtime dependency](https://github.com/apache/doris/blob/39bc832e8e447e295bf817928e64d4aef054fe43/fe/fe-connector/fe-connector-mongodb/pom.xml#L56-L59) inherits 1.1.10.5 from the FE parent. This version is affected by **CVE-2026-108106, CVE-2026-93451, CVE-2026-116590, CVE-2026-93452, CVE-2026-90559 and CVE-2026-108104**. They include allocation/buffer-boundary defects and pooled-buffer double release. **1.1.10.9 is insufficient**: [CVE-2026-108104 / the upstream advisory](https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg) requires 1.1.10.10. The parent pin predates this PR, but the new bundle adds another copy. A module-local override or a coordinated parent upgrade would address this; keep distribution metadata consistent. No matching published advisory was found for **MongoDB Java Driver 5.14.0** or **zstd-jni 1.5.7-25** in the exact-version/vendor checks as of November 5, 2026. The module-local BOM, explicit runtime compression providers, logging exclusions and managed native dependency lookup look reasonable from static dependency inspection. **Impact boundary:** this PR prepares dependencies, stages an unopened FE archive and registers native targets with `NOTADD`; it does not register a MongoDB provider/reader. These are known-vulnerable dependency-version findings, **not demonstrated exploitability through a current Doris SQL path**. No runtime/business-code review, builds or tests were performed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
