This is an automated email from the ASF dual-hosted git repository. xiangfu0 pushed a commit to branch release-1.6.0-rc in repository https://gitbox.apache.org/repos/asf/pinot.git
commit bcdbf2896bb52b9a2c08dcfb4164484deeba62b7 Author: Dylan Dreyer <[email protected]> AuthorDate: Tue Oct 13 12:59:40 2026 -0700 [release/1.6.0-STP-2.211.x] Fix critical/high dependency CVEs (BouncyCastle, jackson, guava, lz4, async-http-client) (#923) * Exclude Pulsar's bundled bouncy-castle-bc (BouncyCastle 1.84) from pinot-pulsar (#900) Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]> (cherry picked from commit b743b12b9f55999ba26b1aa420a110fdf1d444d0) * Bump jackson, guava, lz4-java and async-http-client for CVE fixes Snyk on startree-pinot 2.211.6 flags these in lib/ and the prebuilt plugins: - jackson-core/jackson-databind 2.22.2 -> 2.22.3 (CVE-2026-89425, CVE-2026-91777) - guava 33.4.8/33.6.0 -> 33.7.2-jre (CVE-2026-102554); import guava-bom ahead of libraries-bom so it wins over the version libraries-bom brings in - lz4-java 1.11.3 -> 1.11.4 (CVE-2026-106450, CVE-2026-106451) - async-http-client 3.0.13 -> 3.0.14 (CVE-2026-107230 critical, CVE-2026-107226/7/8) Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]> --- .../pinot-stream-ingestion/pinot-pulsar/pom.xml | 17 +++++++++++++++++ pom.xml | 17 +++++++++++++---- 2 files changed, 30 insertions(+), 4 deletions(-) diff --git a/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml b/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml index a8f7999e5da..b518465b88e 100644 --- a/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml +++ b/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml @@ -40,6 +40,23 @@ <dependency> <groupId>org.apache.pulsar</groupId> <artifactId>pulsar-client</artifactId> + <exclusions> + <!-- bouncy-castle-bc nests its own bcprov/bcpkix/bcutil jars (1.84 in every Pulsar release so far), + bypassing the managed BouncyCastle version. Pulsar loads the BouncyCastle provider from the classpath, + so depend on the managed BouncyCastle artifacts directly instead. --> + <exclusion> + <groupId>org.apache.pulsar</groupId> + <artifactId>bouncy-castle-bc</artifactId> + </exclusion> + </exclusions> + </dependency> + <dependency> + <groupId>org.bouncycastle</groupId> + <artifactId>bcprov-jdk18on</artifactId> + </dependency> + <dependency> + <groupId>org.bouncycastle</groupId> + <artifactId>bcpkix-jdk18on</artifactId> </dependency> <dependency> diff --git a/pom.xml b/pom.xml index 7e1a9a2e664..d07507ad91c 100644 --- a/pom.xml +++ b/pom.xml @@ -190,10 +190,10 @@ <hive.version>4.2.1</hive.version> <helix.version>2.0.1</helix.version> <zkclient.version>0.11</zkclient.version> - <jackson.version>2.22.2</jackson.version> + <jackson.version>2.22.3</jackson.version> <fory.version>1.7.3</fory.version> <zookeeper.version>3.9.6</zookeeper.version> - <async-http-client.version>3.0.13</async-http-client.version> + <async-http-client.version>3.0.14</async-http-client.version> <jersey.version>2.48</jersey.version> <hk2.version>2.6.1</hk2.version> <swagger.version>1.6.16</swagger.version> @@ -213,7 +213,7 @@ <dropwizard-metrics.version>4.2.40</dropwizard-metrics.version> <snappy-java.version>1.1.10.8</snappy-java.version> <zstd-jni.version>1.5.7-16</zstd-jni.version> - <lz4-java.version>1.11.3</lz4-java.version> + <lz4-java.version>1.11.4</lz4-java.version> <libthrift.version>0.24.0</libthrift.version> <log4j.version>2.26.1</log4j.version> <slf4j.version>2.0.19</slf4j.version> @@ -301,6 +301,7 @@ <!-- Google Libraries --> <protobuf.version>4.36.1</protobuf.version> <grpc.version>1.84.0</grpc.version> + <guava.version>33.7.2-jre</guava.version> <google.cloud.libraries.version>26.88.1</google.cloud.libraries.version> <opentelemetry.gcp.resources.version>1.60.0-alpha</opentelemetry.gcp.resources.version> <google.auto-service.version>1.1.1</google.auto-service.version> @@ -1139,7 +1140,15 @@ <type>pom</type> <scope>import</scope> </dependency> - <!-- libraries-bom should be imported after protobuf-bom and grpc-bom to honor their versions --> + <!-- guava-bom --> + <dependency> + <groupId>com.google.guava</groupId> + <artifactId>guava-bom</artifactId> + <version>${guava.version}</version> + <type>pom</type> + <scope>import</scope> + </dependency> + <!-- libraries-bom should be imported after protobuf-bom, grpc-bom and guava-bom to honor their versions --> <dependency> <groupId>com.google.cloud</groupId> <artifactId>libraries-bom</artifactId> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
