This is an automated email from the ASF dual-hosted git repository.
dianfu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new 49a391cd7ed [hotfix][python] Bump io.opentelemetry:opentelemetry-api
from 1.57.0 to 1.62.0 (#28983)
49a391cd7ed is described below
commit 49a391cd7edf55e3289decfa2b2fe29a950fb6c0
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Wed Aug 19 09:45:06 2026 +0800
[hotfix][python] Bump io.opentelemetry:opentelemetry-api from 1.57.0 to
1.62.0 (#28983)
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dian Fu <[email protected]>
---
flink-python/pom.xml | 15 +++++++++++++--
flink-python/src/main/resources/META-INF/NOTICE | 6 +++---
2 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/flink-python/pom.xml b/flink-python/pom.xml
index f5bdeb47eee..ba9f5a44625 100644
--- a/flink-python/pom.xml
+++ b/flink-python/pom.xml
@@ -35,8 +35,8 @@ under the License.
<packaging>jar</packaging>
<properties>
- <!-- Align with Beam ${beam.version} optional transitive. -->
-
<opentelemetry.bundled.version>1.57.0</opentelemetry.bundled.version>
+ <!-- Override Beam's optional transitive with a version that
fixes CVE-2026-45292. -->
+
<opentelemetry.bundled.version>1.62.0</opentelemetry.bundled.version>
<arrow.version>19.0.0</arrow.version>
<surefire.module.config><!--
@@ -751,6 +751,12 @@ under the License.
org.apache.flink.api.python.shaded.com.fasterxml.jackson
</shadedPattern>
</relocation>
+ <relocation>
+
<pattern>io.opentelemetry</pattern>
+
<shadedPattern>
+
org.apache.flink.api.python.shaded.io.opentelemetry
+
</shadedPattern>
+ </relocation>
<!--
Manually
relocate multi-release classes to the correct shaded package. This is needed
due to a bug in
the Maven Shade plugin, which only relocates the content but not
@@ -796,6 +802,11 @@ under the License.
<shadedPattern>META-INF/versions/$1/org/apache/flink/api/python/shaded/io/netty/</shadedPattern>
<rawString>true</rawString>
</relocation>
+ <relocation>
+
<pattern>META-INF/versions/(\d+)/io/opentelemetry/</pattern>
+
<shadedPattern>META-INF/versions/$1/org/apache/flink/api/python/shaded/io/opentelemetry/</shadedPattern>
+
<rawString>true</rawString>
+ </relocation>
<relocation>
<pattern>META-INF/versions/(\d+)/com/google/flatbuffers/</pattern>
<shadedPattern>META-INF/versions/$1/org/apache/flink/api/python/shaded/com/google/flatbuffers/</shadedPattern>
diff --git a/flink-python/src/main/resources/META-INF/NOTICE
b/flink-python/src/main/resources/META-INF/NOTICE
index dc648aa9a32..ab0cdf0791d 100644
--- a/flink-python/src/main/resources/META-INF/NOTICE
+++ b/flink-python/src/main/resources/META-INF/NOTICE
@@ -12,9 +12,9 @@ This project bundles the following dependencies under the
Apache Software Licens
- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.3
- com.google.flatbuffers:flatbuffers-java:25.2.10
- joda-time:joda-time:2.5
-- io.opentelemetry:opentelemetry-api:1.57.0
-- io.opentelemetry:opentelemetry-common:1.57.0
-- io.opentelemetry:opentelemetry-context:1.57.0
+- io.opentelemetry:opentelemetry-api:1.62.0
+- io.opentelemetry:opentelemetry-common:1.62.0
+- io.opentelemetry:opentelemetry-context:1.62.0
- org.apache.arrow:arrow-format:19.0.0
- org.apache.arrow:arrow-memory-core:19.0.0
- org.apache.arrow:arrow-memory-netty:19.0.0
