This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/helix.git
The following commit(s) were added to refs/heads/master by this push:
new 1677a7411 Bump guava to 33.7.2-jre and snappy-java to 1.1.10.9
1677a7411 is described below
commit 1677a741190988ad6f6b22031697dcbd17f520c2
Author: Junkai Xue <[email protected]>
AuthorDate: Tue Nov 10 20:42:55 2026 -0800
Bump guava to 33.7.2-jre and snappy-java to 1.1.10.9
guava 33.7.2 fixes GHSA-xxph-c9ww-hj94 (uncontrolled memory allocation
when deserializing CompactHashMap/CompactHashSet/MapMakerInternalMap).
snappy-java 1.1.10.9 fixes GHSA-q233-g92q-qxp6, GHSA-gwq9-9ffj-mvrv and
GHSA-xqrx-qh46-34m7 (unbounded allocation, heap buffer overflow and JVM
crash on crafted input).
The versions were repeated in several module poms; they are now managed
once in the root pom.
guava stopped depending on jsr305 and checker-qual in 33.4.3 (jspecify
replaces them). javax.annotation.Nullable from jsr305 is used in the
helix-core and meta-client APIs, so both modules now declare jsr305
3.0.2, the version that was resolved before. Nothing in Helix uses
checker-qual; applications that relied on getting it through Helix have
to declare it themselves.
The checked-in ivy files of helix-core, meta-client and
metadata-store-directory-common are updated for the new versions.
---
helix-core/helix-core-2.0.2-SNAPSHOT.ivy | 5 +++--
helix-core/pom.xml | 6 ++++--
meta-client/meta-client-2.0.2-SNAPSHOT.ivy | 1 +
meta-client/pom.xml | 5 ++++-
.../metadata-store-directory-common-2.0.2-SNAPSHOT.ivy | 1 +
metadata-store-directory-common/pom.xml | 1 -
pom.xml | 17 +++++++++++++++++
zookeeper-api/pom.xml | 1 -
8 files changed, 30 insertions(+), 7 deletions(-)
diff --git a/helix-core/helix-core-2.0.2-SNAPSHOT.ivy
b/helix-core/helix-core-2.0.2-SNAPSHOT.ivy
index 0d1e248a3..e3b468a96 100755
--- a/helix-core/helix-core-2.0.2-SNAPSHOT.ivy
+++ b/helix-core/helix-core-2.0.2-SNAPSHOT.ivy
@@ -59,11 +59,12 @@ under the License.
<dependency org="commons-cli" name="commons-cli" rev="1.2"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
<dependency org="commons-math" name="commons-math" rev="2.1"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
<dependency org="org.apache.commons" name="commons-math3" rev="3.6.1"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
- <dependency org="com.google.guava" name="guava" rev="31.1-jre"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
+ <dependency org="com.google.guava" name="guava" rev="33.7.2-jre"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
+ <dependency org="com.google.code.findbugs" name="jsr305" rev="3.0.2"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
<dependency org="org.yaml" name="snakeyaml" rev="1.30"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
<dependency org="commons-logging" name="commons-logging-api" rev="1.1"
conf="compile->compile(*),master(*);runtime->runtime(*)"/>
<dependency org="io.dropwizard.metrics" name="metrics-core" rev="4.1.14"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
- <dependency org="org.xerial.snappy" name="snappy-java" rev="1.1.7"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
+ <dependency org="org.xerial.snappy" name="snappy-java" rev="1.1.10.9"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
</dependencies>
</ivy-module>
diff --git a/helix-core/pom.xml b/helix-core/pom.xml
index 5e9ad5d1a..b39c4f577 100644
--- a/helix-core/pom.xml
+++ b/helix-core/pom.xml
@@ -137,7 +137,10 @@
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
- <version>32.0.0-jre</version>
+ </dependency>
+ <dependency>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
</dependency>
<dependency>
<groupId>org.yaml</groupId>
@@ -162,7 +165,6 @@
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
- <version>1.1.10.4</version>
</dependency>
</dependencies>
<build>
diff --git a/meta-client/meta-client-2.0.2-SNAPSHOT.ivy
b/meta-client/meta-client-2.0.2-SNAPSHOT.ivy
index 01f35ff38..153b60f11 100644
--- a/meta-client/meta-client-2.0.2-SNAPSHOT.ivy
+++ b/meta-client/meta-client-2.0.2-SNAPSHOT.ivy
@@ -44,5 +44,6 @@ under the License.
<artifact name="log4j-slf4j-impl" ext="jar"/>
</dependency>
<dependency org="org.apache.helix" name="zookeeper-api"
rev="2.0.2-SNAPSHOT" force="true"
conf="compile->compile(*),master(*);runtime->runtime(*)"/>
+ <dependency org="com.google.code.findbugs" name="jsr305"
rev="3.0.2" force="true"
conf="compile->compile(*),master(*);runtime->runtime(*)"/>
</dependencies>
</ivy-module>
diff --git a/meta-client/pom.xml b/meta-client/pom.xml
index 603d60f76..5ce095981 100644
--- a/meta-client/pom.xml
+++ b/meta-client/pom.xml
@@ -56,6 +56,10 @@ under the License.
<artifactId>zookeeper-api</artifactId>
<version>${project.version}</version>
</dependency>
+ <dependency>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ </dependency>
<dependency>
<groupId>org.testng</groupId>
<artifactId>testng</artifactId>
@@ -70,7 +74,6 @@ under the License.
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
- <version>1.1.10.4</version>
<scope>test</scope>
</dependency>
<dependency>
diff --git
a/metadata-store-directory-common/metadata-store-directory-common-2.0.2-SNAPSHOT.ivy
b/metadata-store-directory-common/metadata-store-directory-common-2.0.2-SNAPSHOT.ivy
index b9c50d800..6aaa6129e 100644
---
a/metadata-store-directory-common/metadata-store-directory-common-2.0.2-SNAPSHOT.ivy
+++
b/metadata-store-directory-common/metadata-store-directory-common-2.0.2-SNAPSHOT.ivy
@@ -50,5 +50,6 @@ under the License.
<dependency org="com.fasterxml.jackson.core"
name="jackson-databind" rev="2.12.6.1" force="true"
conf="compile->compile(*),master(*);runtime->runtime(*)"/>
<dependency org="commons-cli" name="commons-cli" rev="1.2"
force="true" conf="compile->compile(*),master(*);runtime->runtime(*)"/>
<dependency org="commons-io" name="commons-io" rev="2.11.0"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
+ <dependency org="com.google.guava" name="guava"
rev="33.7.2-jre"
conf="compile->compile(default);runtime->runtime(default);default->default"/>
</dependencies>
</ivy-module>
diff --git a/metadata-store-directory-common/pom.xml
b/metadata-store-directory-common/pom.xml
index b3411aa9c..2ab688946 100644
--- a/metadata-store-directory-common/pom.xml
+++ b/metadata-store-directory-common/pom.xml
@@ -87,7 +87,6 @@
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
- <version>32.0.0-jre</version>
<scope>compile</scope>
</dependency>
<dependency>
diff --git a/pom.xml b/pom.xml
index 8cc2d7aeb..4ebe848aa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -479,6 +479,23 @@
<dependencyManagement>
<dependencies>
+ <dependency>
+ <groupId>com.google.guava</groupId>
+ <artifactId>guava</artifactId>
+ <version>33.7.2-jre</version>
+ </dependency>
+ <dependency>
+ <!-- javax.annotation.Nullable is used in the Helix APIs. guava
brought it in transitively
+ up to 33.4.2 and no longer does, so the modules that use it
declare it. -->
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ <version>3.0.2</version>
+ </dependency>
+ <dependency>
+ <groupId>org.xerial.snappy</groupId>
+ <artifactId>snappy-java</artifactId>
+ <version>1.1.10.9</version>
+ </dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
diff --git a/zookeeper-api/pom.xml b/zookeeper-api/pom.xml
index b58f48ae4..a46f87a94 100644
--- a/zookeeper-api/pom.xml
+++ b/zookeeper-api/pom.xml
@@ -125,7 +125,6 @@
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
- <version>1.1.10.4</version>
<scope>test</scope>
</dependency>
</dependencies>
