manuzhang opened a new pull request, #3892: URL: https://github.com/apache/parquet-java/pull/3892
### Rationale for this change Backport #3851 and #3865 to `parquet-1.18.x` so 1.18.2 includes Snappy's input-validation security fixes and the subsequent Hadoop compatibility corrections. The branch currently uses snappy-java 1.1.10.8. Upstream security changes: https://github.com/xerial/snappy-java/pull/739 ### What changes are included in this PR? Upgrade `org.xerial.snappy:snappy-java` directly from 1.1.10.8 to 1.1.10.12 in `parquet-hadoop/pom.xml`. This combines the two main-branch upgrades in one maintenance commit. It is independent of the Thrift upgrade. ### Are these changes tested? - Clean Java 11 `parquet-hadoop` reactor `verify`, using the branch's unchanged Thrift 0.23.0 compiler/runtime: 99 tests, 0 failures/errors/skips. - Covers `TestSnappyCodec`, `TestCompressionCodec`, `TestDirectCodecFactory`, `TestParquetWriter`, `TestParquetReader`, and `TestDataPageChecksums`. - Confirmed the test runtime uses snappy-java 1.1.10.12. - Configured API-compatibility, dependency-analysis, RAT and Spotless checks passed; `git diff --check` passed. Broad integration tests and Javadocs were skipped. ### Are there any user-facing changes? Snappy rejects malformed inputs and unsafe buffer sizes earlier. The selected version includes the later Hadoop ByteBuffer/header compatibility fixes. No Parquet file-format change is introduced. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
