AshishDaga161 opened a new issue, #3857: URL: https://github.com/apache/parquet-java/issues/3857
## Summary `parquet-jackson-1.18.1.jar` bundles a shaded copy of jackson-core and jackson-databind **2.22.2**. Vulnerability scanners (grype) flag these as High against the bundled copy, even when the application itself uses jackson 2.22.3 on the classpath. The jackson 2.22.3 bump is already merged on the maintenance branch (#3846, `parquet-1.18.x`, merged 2026-10-10), but there is no `1.18.2` release on Maven Central yet, so downstream users on 1.18.1 cannot pick up the fix. ## Affected findings (grype, against parquet-jackson-1.18.1.jar) - GHSA-7hhh-6rmp-j9qf (jackson-core, High) - GHSA-p6pp-m3f8-5c89 (jackson-core, High) - GHSA-cxp5-3px4-pw24 (jackson-databind, High) - GHSA-wv8q-qhhj-9h54 (jackson-databind, High) Fixed version reported by grype: 2.22.3. ## Workaround attempted and why it does not work Excluding `parquet-jackson` from `parquet-hadoop` / `parquet-avro` removes the shaded classes, and our write-path tests then fail: ``` NoClassDefFound: shaded/parquet/com/fasterxml/jackson/databind/ObjectMapper NoClassDefFound: org.apache.parquet.hadoop.metadata.ParquetMetadata (Could not initialize class) ``` `parquet-hadoop` (crypto/keytools `HadoopFSKeyMaterialStore`, `KeyMaterial`) references the shaded jackson classes directly, so downstream consumers cannot drop the shaded jar without breaking parquet writes. ## Request 1. Is a `1.18.2` (or equivalent) release planned from `parquet-1.18.x` with the jackson 2.22.3 bump? Any target date? 2. Related open issues that look connected: #3668 (planned release with CVE-2026-54512/54513), #3690 (audit of third-party code bundled in published JARs), #3693 (1.17.1 fails vulnerability scans). Versions observed: parquet 1.18.1 (latest on Maven Central), jackson 2.22.2 bundled. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
