CalvinKirs opened a new pull request, #67065:
URL: https://github.com/apache/doris/pull/67065
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary: FE resolves `grpc-netty-shaded` 1.65.1 and Nimbus JOSE+JWT
10.0.1, which are affected by CVE-2025-55163 and CVE-2025-53864. Upgrade the
managed gRPC BOM to 1.75.0 and Nimbus JOSE+JWT to 10.0.2 so all FE consumers
resolve security-fixed versions.
### Release note
Upgrade FE gRPC to 1.75.0 and Nimbus JOSE+JWT to 10.0.2.
### Check List (For Author)
- Test: Manual test
- Generated FE gRPC sources successfully
- Verified all `io.grpc` dependencies converge to 1.75.0
- Rebuilt and packaged `fe-grpc` with Maven build cache disabled;
checkstyle passed
- Verified Nimbus dependencies converge to 10.0.2 across Hadoop and
Trino consumers
- Rebuilt the affected Nimbus consumer modules with Maven build cache
disabled
- Full `build.sh --fe` was not completed because an unrelated local
`build.sh` change references the missing `fe-connector/fe-connector-api` module
- Behavior changed: Yes (upgrades FE runtime dependency versions to
security-fixed releases)
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
