Yicong-Huang opened a new pull request, #6216: URL: https://github.com/apache/texera/pull/6216
### What changes were proposed in this PR? Backport of apache/texera#6208 to `release/v1.2`: upgrade Apache Iceberg from 1.7.1 to 1.9.2 in `common/workflow-core`. Iceberg 1.7.1 transitively pulls `org.apache.parquet:parquet-avro` 1.13.1, flagged by two open Dependabot alerts: - **CVE-2025-30065** (critical): schema parsing in the parquet-avro module allows arbitrary code execution; fixed in parquet 1.15.1. - **CVE-2025-46762** (high): fixed in parquet 1.15.2. Iceberg 1.9.2 is the smallest Iceberg release whose official dependency set pairs with parquet 1.15.2. As on `main`, one source change was required: Iceberg 1.9 added a `BiFunction` overload to `Parquet.DataWriteBuilder#createWriterFunc` and deprecated `GenericParquetWriter.buildWriter(MessageType)`, so `IcebergTableWriter.flushBuffer` now uses the replacement API `GenericParquetWriter.create(Schema, MessageType)` via an explicit lambda. The new `IcebergTableWriterSpec` is included as well. Cherry-pick of db00f9416 with conflicts resolved: - The source changes (`build.sbt`, `IcebergTableWriter.scala`, `IcebergTableWriterSpec.scala`) apply cleanly. - The manifest changes conflicted (this is also why the automated backport pre-check on the original PR failed) and the `LICENSE-binary`(-java) / `NOTICE-binary` sets were instead **regenerated from freshly built `release/v1.2` dists** rather than taken from `main`, because `main`'s manifests reflect a dependency tree this branch does not have (e.g. jackson 2.21, guava 33.5.0-android, grpc 1.79, protobuf 4.33 are `main`-only). The iceberg/parquet drift itself is the same 23-entry set as on `main` (iceberg 1.9.2, parquet 1.15.2, zstd-jni, aircompressor, httpclient5/httpcore5, orc, audience-annotations, snappy-java). `NOTICE-binary` files were regenerated with `generate_notice_binary.py` (amber with `--extras amber/NOTICE-binary-python`). ### Any related issues, documentation, discussions? Backports apache/texera#6208 (merged to `main`), which resolves #6207. Dependabot alerts: [#714](https://github.com/apache/texera/security/dependabot/714), [#716](https://github.com/apache/texera/security/dependabot/716). No `release/*` label is added — this PR *is* the backport. ### How was this PR tested? - Built the four affected dists on this branch and ran `check_binary_deps.py` (strict mode) and `generate_notice_binary.py` against each unzipped dist — all pass, and the bundled parquet family resolves to 1.15.2. - `sbt WorkflowCore/test`: all tests pass on this branch, including the Iceberg integration specs and the new `IcebergTableWriterSpec`. (The `S3StorageClientSpec`/`LargeBinary*`/`IcebergDocumentConsoleMessagesSpec` suite aborts are environmental — missing external MinIO and a stale local iceberg-catalog entry — and reproduce identically on unmodified `release/v1.2`.) ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Fable 5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
