This is an automated email from the ASF dual-hosted git repository. xiangfu0 pushed a commit to branch xiangfu0/codex2/parquet-jackson-security in repository https://gitbox.apache.org/repos/asf/pinot.git
commit 75c0081fd787977de77ce7ae73177b8dbcd09d93 Author: Xiang Fu <[email protected]> AuthorDate: Sat Oct 10 22:08:35 2026 -0700 Fix Reactor Core and remove unused HTTP server code Reproduction: packaged ADLS clients resolve affected Reactor Core timeout operators and retain the HTTP server pipelining handler covered by CVE-2026-47874. StarTree distributions copy this shaded plugin directly. Manage fixed Reactor Core 3.8.7 and align the Netty 4.1-compatible client transport. Remove unused HTTP server classes from direct and already shaded inputs; retain client metadata. Scoped ADLS packaging, convergence, POM checks and packaged client construction pass. --- pom.xml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/pom.xml b/pom.xml index 2a81d0bdd45..be84e246d57 100644 --- a/pom.xml +++ b/pom.xml @@ -219,6 +219,8 @@ <log4j.version>2.26.1</log4j.version> <slf4j.version>2.0.20</slf4j.version> <netty.version>4.1.139.Final</netty.version> + <reactor-netty.version>1.2.18</reactor-netty.version> + <reactor-core.version>3.8.7</reactor-core.version> <reactivestreams.version>1.0.4</reactivestreams.version> <jts.version>1.20.0</jts.version> <h3.version>4.5.0</h3.version> @@ -807,6 +809,23 @@ <scope>import</scope> </dependency> + <!-- Align Azure transports with the fixed Reactor Core release. --> + <dependency> + <groupId>io.projectreactor.netty</groupId> + <artifactId>reactor-netty-core</artifactId> + <version>${reactor-netty.version}</version> + </dependency> + <dependency> + <groupId>io.projectreactor.netty</groupId> + <artifactId>reactor-netty-http</artifactId> + <version>${reactor-netty.version}</version> + </dependency> + <dependency> + <groupId>io.projectreactor</groupId> + <artifactId>reactor-core</artifactId> + <version>${reactor-core.version}</version> + </dependency> + <dependency> <groupId>org.reactivestreams</groupId> <artifactId>reactive-streams</artifactId> @@ -2964,6 +2983,11 @@ <exclude>shaded/parquet/com/fasterxml/jackson/**</exclude> <exclude>META-INF/versions/**/shaded/parquet/com/fasterxml/jackson/**</exclude> + <!-- Azure storage uses only HTTP clients. Remove the unused Reactor Netty HTTP server + and its vulnerable pipelining handler (CVE-2026-47874), including already shaded inputs. --> + <exclude>reactor/netty/http/server/**</exclude> + <exclude>META-INF/versions/**/reactor/netty/http/server/**</exclude> + <!-- Exclude NettyInstance because it includes Netty package literals --> <exclude>src/main/java/org/apache/pinot/core/transport/NettyInstance.java</exclude> </excludes> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
