samibashe commented on PR #56172: URL: https://github.com/apache/spark/pull/56172#issuecomment-6154775102
We run Spark 4.2.0 on Kubernetes and are flagged for CVE-2026-6790 (GHSA-7p3p-8qv8-m2vh) in the jetty-server 12.1.8 shaded into spark-core. This upgrade carries fix version 5.0.0 only, and branch-4.2 is still on 12.1.8 as of the 4.2.1 RC2 tag. Would the project consider backporting the Jetty 12.1.9+ bump to branch-4.2 for 4.2.2? Thanks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
