dependabot[bot] opened a new pull request, #18247: URL: https://github.com/apache/hudi/pull/18247
### Describe the issue this Pull Request addresses `io.airlift:aircompressor` 0.27 is affected by CVE-2025-67721 (CVSS 8.2 High, GHSA-vx9q-rhv9-3jvg): the Java LZ4 and Snappy decompressors can leak previous contents of a reused output buffer when fed crafted compressed input. On the legacy `io.airlift:aircompressor` coordinates, 2.0.3 is the only release containing the fix (there is no patched 0.27.x). Hudi bundles ship aircompressor unrelocated under `io/airlift/compress/**`, so released bundles keep getting flagged by security scanners until this is bumped. ### Summary and Changelog Bumps `airlift.version` from 0.27 to 2.0.3 in the root pom. This property backs the `dependencyManagement` pin on `io.airlift:aircompressor`, which governs the direct dependency in `hudi-io` and the transitive resolution for ORC and parquet-hadoop. Compatibility notes (verified by comparing the 0.27 and 2.0.3 jars): - The version jump is smaller than it looks: there is no 1.x line, and 2.x continues the pure-Java library on the same coordinates. The FFM/native rewrite lives in the separate `io.airlift:aircompressor-v3` artifact, which this PR does not touch. - Package layout is unchanged (`io.airlift.compress.*`). `JdkGzipHadoopStreams`, `HadoopInputStream`, and `HadoopOutputStream` used by `HoodieAirliftGzipCompressor` have identical signatures in both versions. - The root `Compressor`/`Decompressor` interfaces and the lz4/snappy/zstd/lzo classes used transitively by ORC and parquet-hadoop are unchanged. - The 2.0.3 jar targets Java 8 bytecode (class major version 52) and contains no native libraries, so Hudi's Java build targets and runtimes are unaffected. - `hudi-trino-plugin` parents `trino-root`, not the Hudi root pom, so it is not affected by this pin. ### Impact No public API or user-facing change. Hudi's direct usage (HFile GZIP compression in `hudi-io` via `HoodieAirliftGzipCompressor`) is behaviorally unchanged; ORC and Parquet LZ4/Snappy decompression paths on Hudi classpaths pick up the CVE-2025-67721 fix. ### Risk Level low. Binary compatibility was verified with javap against both jars for every aircompressor class used by Hudi, ORC, and parquet-hadoop. Existing `hudi-io` tests (`TestHoodieCompressor` and the GZ-compressed HFile fixture tests) exercise the airlift GZIP path in CI. ### Documentation Update none ### Contributor's checklist - [x] Read through [contributor's guide](https://hudi.apache.org/contribute/how-to-contribute) - [x] Enough context is provided in the sections above - [x] Adequate tests were added if applicable --- Bumps [io.airlift:aircompressor](https://github.com/airlift/aircompressor) from 0.27 to 2.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/airlift/aircompressor/releases";>io.airlift:aircompressor's releases</a>.</em></p> <blockquote> <h2>aircompressor 2.0.3</h2> <h2>What's Changed</h2> <ul> <li>Backport fixes for CVE-2025-67721 by <a href="https://github.com/ali-ince";><code>@ali-ince</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/309";>airlift/aircompressor#309</a></li> <li>Add njord release workflow to 2.x by <a href="https://github.com/wendigo";><code>@wendigo</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/323";>airlift/aircompressor#323</a></li> <li>Update gpg plugin to 3.2.8 by <a href="https://github.com/wendigo";><code>@wendigo</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/325";>airlift/aircompressor#325</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ali-ince";><code>@ali-ince</code></a> made their first contribution in <a href="https://redirect.github.com/airlift/aircompressor/pull/309";>airlift/aircompressor#309</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/airlift/aircompressor/compare/2.0.2...2.0.3";>https://github.com/airlift/aircompressor/compare/2.0.2...2.0.3</a></p> <h2>Release 2.0</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Others</h3> <ul> <li>Initial v2 changes by <a href="https://github.com/dain";><code>@dain</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/189";>airlift/aircompressor#189</a></li> <li>Add dependabot by <a href="https://github.com/Fokko";><code>@Fokko</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/166";>airlift/aircompressor#166</a></li> <li>Bump actions/checkout from 1 to 4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/191";>airlift/aircompressor#191</a></li> <li>Bump io.airlift:airbase from 153 to 154 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/192";>airlift/aircompressor#192</a></li> <li>Bump com.github.luben:zstd-jni from 1.5.5-11 to 1.5.6-3 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/193";>airlift/aircompressor#193</a></li> <li>Bump actions/setup-java from 3 to 4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/190";>airlift/aircompressor#190</a></li> <li>Add native Lz4, Snappy, and Zstd by <a href="https://github.com/dain";><code>@dain</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/201";>airlift/aircompressor#201</a></li> <li>Fix download paths by <a href="https://github.com/martint";><code>@martint</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/205";>airlift/aircompressor#205</a></li> <li>Fix temp path construction by <a href="https://github.com/martint";><code>@martint</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/204";>airlift/aircompressor#204</a></li> <li>Release workflow by <a href="https://github.com/wendigo";><code>@wendigo</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/212";>airlift/aircompressor#212</a></li> <li>Add factory to create a (de)compressor based on native availability by <a href="https://github.com/wendigo";><code>@wendigo</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/203";>airlift/aircompressor#203</a></li> <li>Add system properties to README by <a href="https://github.com/wendigo";><code>@wendigo</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/217";>airlift/aircompressor#217</a></li> <li>Bump org.xerial.snappy:snappy-java from 1.1.10.5 to 1.1.10.6 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/215";>airlift/aircompressor#215</a></li> <li>Do not require Hadoop native zlib by <a href="https://github.com/dain";><code>@dain</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/214";>airlift/aircompressor#214</a></li> <li>Bump io.airlift:airbase from 160 to 163 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/218";>airlift/aircompressor#218</a></li> <li>Bump com.github.luben:zstd-jni from 1.5.6-3 to 1.5.6-4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/airlift/aircompressor/pull/208";>airlift/aircompressor#208</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Fokko";><code>@Fokko</code></a> made their first contribution in <a href="https://redirect.github.com/airlift/aircompressor/pull/166";>airlift/aircompressor#166</a></li> <li><a href="https://github.com/dependabot";><code>@dependabot</code></a> made their first contribution in <a href="https://redirect.github.com/airlift/aircompressor/pull/191";>airlift/aircompressor#191</a></li> <li><a href="https://github.com/wendigo";><code>@wendigo</code></a> made their first contribution in <a href="https://redirect.github.com/airlift/aircompressor/pull/212";>airlift/aircompressor#212</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/airlift/aircompressor/compare/0.27...2.0";>https://github.com/airlift/aircompressor/compare/0.27...2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/airlift/aircompressor/commit/b98c7d8d35eb6b294316dbd84067894a6e768df7";><code>b98c7d8</code></a> [maven-release-plugin] prepare release 2.0.3</li> <li><a href="https://github.com/airlift/aircompressor/commit/c58c3db7a3ff5aff78039c13f1ff7c765106478b";><code>c58c3db</code></a> Delete release.yml</li> <li><a href="https://github.com/airlift/aircompressor/commit/a9bff171bf654fd97ed4bf87cf9679abcbc0eddc";><code>a9bff17</code></a> Update gpg plugin to 3.2.8</li> <li><a href="https://github.com/airlift/aircompressor/commit/a6de160591d0a72c34923437fa267a568c7ad958";><code>a6de160</code></a> Rename release-2x.yml to release.yml</li> <li><a href="https://github.com/airlift/aircompressor/commit/2af2557d77a8711baacc48d28660c759a76bf0eb";><code>2af2557</code></a> Add njord release workflow to 2.x</li> <li><a href="https://github.com/airlift/aircompressor/commit/35152dc59a211642a2ba02f0587bb19d552bf04e";><code>35152dc</code></a> Backport fix LZ4 decompressor data leak when match offset is zero</li> <li><a href="https://github.com/airlift/aircompressor/commit/596042af4c6e7a08270f8421137642561cfe88dc";><code>596042a</code></a> Backport fix data leak when snappy match offset is zero</li> <li><a href="https://github.com/airlift/aircompressor/commit/869ef20268f6e1e57b454e32c7ee28c19e030f2d";><code>869ef20</code></a> [maven-release-plugin] prepare for next development iteration</li> <li><a href="https://github.com/airlift/aircompressor/commit/36fe717d29ca455a268cdcd6ecf8b72e3f9bf211";><code>36fe717</code></a> [maven-release-plugin] prepare release 2.0.2</li> <li><a href="https://github.com/airlift/aircompressor/commit/8d24b66da7be35ac9edbad9e047a4122123bcd39";><code>8d24b66</code></a> Revert "Upgrade to Airbase 163"</li> <li>Additional commits viewable in <a href="https://github.com/airlift/aircompressor/compare/0.27...2.0.3";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/hudi/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
