manuzhang opened a new pull request, #3891: URL: https://github.com/apache/parquet-java/pull/3891
### Rationale for this change Backport #3855 to `parquet-1.18.x` so 1.18.2 includes Apache Thrift 0.25.0 security fixes. The branch currently uses 0.23.0, including the shaded runtime in `parquet-format-structures`. Apache's security announcement: https://www.openwall.com/lists/oss-security/2026/10/04/1 ### What changes are included in this PR? - Upgrade the runtime and compiler directly from 0.23.0 to 0.25.0. - Align the CI compiler installation and README instructions. - Implement `StubTTransport.resetMessageSizeAndConsumedBytes(long)`, required by the new Thrift API. Adapted from `b97860d7` (#3855). The maintenance branch has no developer Docker image; unrelated Maven-wrapper changes from the original PR are omitted. ### Are these changes tested? - Clean Java 11 reactor `verify` for `parquet-thrift` and its dependencies with Thrift compiler 0.25.0: 261 tests, 0 failures/errors, 2 existing disabled array-compatibility tests. - Includes all `parquet-thrift` tests and focused metadata, message-size, encryption, Parquet reader/writer tests. - Configured API-compatibility, dependency-analysis, RAT and Spotless checks passed; `git diff --check` and CI script syntax check passed. - Inspected the packaged format-structures JAR: relocated Thrift runtime includes the new transport API, no unshaded Thrift classes, and base classfiles remain Java 11-compatible. Broad integration tests and Javadocs were skipped. ### Are there any user-facing changes? Builds require Thrift compiler 0.25.0. The runtime includes stricter validation for malformed input; the required `libthrift` version for `parquet-thrift` is updated. No Parquet file-format or public Parquet API change is introduced. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
