This is an automated email from the ASF dual-hosted git repository.
StevenLuMT pushed a commit to branch branch-4.17
in repository https://gitbox.apache.org/repos/asf/bookkeeper.git
The following commit(s) were added to refs/heads/branch-4.17 by this push:
new 182da54eea Upgrade thrift to 0.23.0 to address CVE-2026-43869 (#4791)
182da54eea is described below
commit 182da54eeac2cd5a5dd7718a35c696dacba8f868
Author: Lari Hotari <[email protected]>
AuthorDate: Wed May 13 05:35:05 2026 +0800
Upgrade thrift to 0.23.0 to address CVE-2026-43869 (#4791)
(cherry picked from commit 3565d0e289c3bc9c638ba435c4165bc66b5268d8)
---
.../src/main/resources/LICENSE-all.bin.txt | 4 ++--
.../src/main/resources/LICENSE-bkctl.bin.txt | 4 ++--
.../src/main/resources/LICENSE-server.bin.txt | 4 ++--
pom.xml | 23 +++++++++++++++++++++-
4 files changed, 28 insertions(+), 7 deletions(-)
diff --git a/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt
b/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt
index a654011385..1ea12c953e 100644
--- a/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt
+++ b/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt
@@ -308,7 +308,7 @@ Apache Software License, Version 2.
- lib/org.jctools-jctools-core-2.1.2.jar [38]
- lib/org.apache.httpcomponents-httpclient-4.5.13.jar [39]
- lib/org.apache.httpcomponents-httpcore-4.4.15.jar [40]
-- lib/org.apache.thrift-libthrift-0.14.2.jar [41]
+- lib/org.apache.thrift-libthrift-0.23.0.jar [41]
- lib/com.google.android-annotations-4.1.1.4.jar [42]
- lib/com.google.http-client-google-http-client-1.44.2.jar [43]
- lib/com.google.http-client-google-http-client-gson-1.44.2.jar [43]
@@ -393,7 +393,7 @@ Apache Software License, Version 2.
[38] Source available at https://github.com/JCTools/JCTools/tree/v2.1.2
[39] Source available at
https://github.com/apache/httpcomponents-client/tree/rel/v4.5.13
[40] Source available at
https://github.com/apache/httpcomponents-core/tree/rel/v4.4.15
-[41] Source available at https://github.com/apache/thrift/tree/0.14.2
+[41] Source available at https://github.com/apache/thrift/tree/0.23.0
[42] Source available at https://source.android.com/
[43] Source available at
https://github.com/googleapis/google-http-java-client/releases/tag/v1.43.3
[44] Source available at
https://github.com/google/auto/releases/tag/auto-value-1.10.4
diff --git a/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt
b/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt
index 5f5b8f8e64..2bdaff3d23 100644
--- a/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt
+++ b/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt
@@ -279,7 +279,7 @@ Apache Software License, Version 2.
- lib/org.jctools-jctools-core-2.1.2.jar [37]
- lib/org.apache.httpcomponents-httpclient-4.5.13.jar [38]
- lib/org.apache.httpcomponents-httpcore-4.4.15.jar [39]
-- lib/org.apache.thrift-libthrift-0.14.2.jar [40]
+- lib/org.apache.thrift-libthrift-0.23.0.jar [40]
- lib/com.google.android-annotations-4.1.1.4.jar [41]
- lib/com.google.auto.value-auto-value-annotations-1.11.0.jar [42]
- lib/com.google.http-client-google-http-client-1.44.2.jar [43]
@@ -335,7 +335,7 @@ Apache Software License, Version 2.
[37] Source available at https://github.com/JCTools/JCTools/tree/v2.1.2
[38] Source available at
https://github.com/apache/httpcomponents-client/tree/rel/v4.5.13
[39] Source available at
https://github.com/apache/httpcomponents-core/tree/rel/v4.4.15
-[40] Source available at https://github.com/apache/thrift/tree/0.14.2
+[40] Source available at https://github.com/apache/thrift/tree/0.23.0
[41] Source available at https://source.android.com/
[42] Source available at
https://github.com/google/auto/releases/tag/auto-value-1.10.4
[43] Source available at
https://github.com/googleapis/google-http-java-client/releases/tag/v1.43.3
diff --git a/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt
b/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt
index 75a07de7a9..c7126000d4 100644
--- a/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt
+++ b/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt
@@ -308,7 +308,7 @@ Apache Software License, Version 2.
- lib/org.jctools-jctools-core-2.1.2.jar [38]
- lib/org.apache.httpcomponents-httpclient-4.5.13.jar [39]
- lib/org.apache.httpcomponents-httpcore-4.4.15.jar [40]
-- lib/org.apache.thrift-libthrift-0.14.2.jar [41]
+- lib/org.apache.thrift-libthrift-0.23.0.jar [41]
- lib/com.google.android-annotations-4.1.1.4.jar [42]
- lib/com.google.http-client-google-http-client-1.44.2.jar [43]
- lib/com.google.http-client-google-http-client-gson-1.44.2.jar [43]
@@ -389,7 +389,7 @@ Apache Software License, Version 2.
[38] Source available at https://github.com/JCTools/JCTools/tree/v2.1.2
[39] Source available at
https://github.com/apache/httpcomponents-client/tree/rel/v4.5.13
[40] Source available at
https://github.com/apache/httpcomponents-core/tree/rel/v4.4.15
-[41] Source available at https://github.com/apache/thrift/tree/0.14.2
+[41] Source available at https://github.com/apache/thrift/tree/0.23.0
[42] Source available at https://source.android.com/
[43] Source available at
https://github.com/googleapis/google-http-java-client/releases/tag/v1.43.3
[44] Source available at
https://github.com/google/auto/releases/tag/auto-value-1.10.4
diff --git a/pom.xml b/pom.xml
index a5ac119ba6..4771d38a22 100644
--- a/pom.xml
+++ b/pom.xml
@@ -151,7 +151,7 @@
<junit5.version>5.10.2</junit5.version>
<assertj-core.version>3.25.3</assertj-core.version>
<awaitility.version>4.2.0</awaitility.version>
- <libthrift.version>0.14.2</libthrift.version>
+ <libthrift.version>0.23.0</libthrift.version>
<lombok.version>1.18.30</lombok.version>
<log4j.version>2.18.0</log4j.version>
<lz4-java.version>1.10.2</lz4-java.version>
@@ -379,6 +379,7 @@
<artifactId>libthrift</artifactId>
<version>${libthrift.version}</version>
<exclusions>
+ <!-- Only TJSON/TMemory APIs are used; exclude HTTP/servlet
transports and their transitives -->
<exclusion>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
@@ -387,6 +388,26 @@
<groupId>javax.annotation</groupId>
<artifactId>javax.annotation-api</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>jakarta.annotation</groupId>
+ <artifactId>jakarta.annotation-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>jakarta.servlet</groupId>
+ <artifactId>jakarta.servlet-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.httpcomponents.client5</groupId>
+ <artifactId>httpclient5</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.httpcomponents.core5</groupId>
+ <artifactId>httpcore5</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.httpcomponents.core5</groupId>
+ <artifactId>httpcore5-h2</artifactId>
+ </exclusion>
</exclusions>
</dependency>
