This is an automated email from the ASF dual-hosted git repository.
stevel pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/hadoop.git
The following commit(s) were added to refs/heads/trunk by this push:
new 3baa2889823 HADOOP-19632. Upgrade nimbus-jose-jwt to 10.4 (#7965)
3baa2889823 is described below
commit 3baa288982333fbbc3839cf55baaf36f49e0f7b6
Author: rohit-kb <[email protected]>
AuthorDate: Tue Sep 23 21:05:44 2025 +0530
HADOOP-19632. Upgrade nimbus-jose-jwt to 10.4 (#7965)
Addresses CVE-2025-53864
Contributed by Rohit Kumar
---
LICENSE-binary | 2 +-
hadoop-project/pom.xml | 8 +++++++-
hadoop-tools/hadoop-sls/pom.xml | 5 +++++
.../hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml | 5 +++++
.../hadoop-yarn-server/hadoop-yarn-server-router/pom.xml | 6 +++++-
5 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/LICENSE-binary b/LICENSE-binary
index 1987517714a..c9d53de7798 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -269,7 +269,7 @@ com.google.http-client:google-http-client:1.46.3
com.google.j2objc:j2objc-annotations:3.0.0
com.google.oauth-client:google-oauth-client:1.37.0
com.microsoft.azure:azure-storage:7.0.0
-com.nimbusds:nimbus-jose-jwt:9.37.2
+com.nimbusds:nimbus-jose-jwt:10.4
com.zaxxer:HikariCP:4.0.3
commons-beanutils:commons-beanutils:1.9.4
commons-cli:commons-cli:1.9.0
diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
index a699daf09a2..ba16ed9b34e 100644
--- a/hadoop-project/pom.xml
+++ b/hadoop-project/pom.xml
@@ -245,7 +245,8 @@
<openssl-wildfly.version>2.1.4.Final</openssl-wildfly.version>
<jsonschema2pojo.version>1.0.2</jsonschema2pojo.version>
<woodstox.version>5.4.0</woodstox.version>
- <nimbus-jose-jwt.version>9.37.2</nimbus-jose-jwt.version>
+ <nimbus-jose-jwt.version>10.4</nimbus-jose-jwt.version>
+ <jcip-annotations.version>1.0-1</jcip-annotations.version>
<nodejs.version>v12.22.1</nodejs.version>
<yarnpkg.version>v1.22.5</yarnpkg.version>
<apache-ant.version>1.10.13</apache-ant.version>
@@ -1551,6 +1552,11 @@
<artifactId>jsr305</artifactId>
<version>3.0.2</version>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <version>${jcip-annotations.version}</version>
+ </dependency>
<dependency>
<groupId>jakarta.xml.bind</groupId>
<artifactId>jakarta.xml.bind-api</artifactId>
diff --git a/hadoop-tools/hadoop-sls/pom.xml b/hadoop-tools/hadoop-sls/pom.xml
index 59b7f2482cd..a822372bd00 100644
--- a/hadoop-tools/hadoop-sls/pom.xml
+++ b/hadoop-tools/hadoop-sls/pom.xml
@@ -93,6 +93,11 @@
<artifactId>junit-platform-launcher</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
diff --git
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
index 023b48889bc..b02097814aa 100644
---
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
+++
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
@@ -354,6 +354,11 @@
<artifactId>junit-platform-launcher</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
diff --git
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
index a991709934c..eeb3e6f0753 100644
---
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
+++
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
@@ -168,7 +168,11 @@
<artifactId>assertj-core</artifactId>
<scope>test</scope>
</dependency>
-
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
