xiangfu0 opened a new pull request, #19807: URL: https://github.com/apache/pinot/pull/19807
Parquet bundles Jackson 2.22.2 even though master manages 2.22.3. Shaded Parquet plugins therefore retain the older classes and related vulnerability findings. Filter the embedded classes and relocate Parquet references to the managed Jackson copy, including when consuming an already shaded plugin. ### Reproduction Package `pinot-parquet` on master and inspect its shaded JAR: both `shaded/parquet/com/fasterxml/jackson` 2.22.2 and the managed Jackson 2.22.3 are present. ### Validation - Scoped `pinot-parquet` package and three existing reader tests passed. - With only the packaged shaded JAR on the classpath, Parquet metadata serialization and encryption JSON round trip passed. - The JAR contains no old Parquet Jackson classes or bytecode references; Trivy analyzed 131 packages and found no Jackson vulnerabilities. Five separate existing JLine findings remain. - Root formatting, checkstyle and license checks passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
