FrankChen021 opened a new pull request, #19807: URL: https://github.com/apache/druid/pull/19807
## What changed Upgrade `com.nimbusds:nimbus-jose-jwt` from `9.37.3` to `9.37.4` in the `druid-pac4j` extension. ## Why Dependabot alert #438 reports CVE-2025-53864 / GHSA-xwmg-2g98-w7v9. Versions before `9.37.4` can consume excessive resources when parsing deeply nested JSON, allowing a denial-of-service attack. The vulnerable version is pinned directly in `extensions-core/druid-pac4j/pom.xml`. This change uses the first patched release and stays on the existing `9.37.x` API line, minimizing compatibility risk. ## Impact JWT parsing and OpenID Connect authentication use the patched Nimbus implementation. No Druid configuration or API changes are required. ## Tests - `mvn -ntp test -pl extensions-core/druid-pac4j -am -Dtest="org.apache.druid.security.pac4j.JwtAuthenticatorTest" -Dsurefire.failIfNoSpecifiedTests=false -Pskip-static-checks -Dweb.console.skip=true -T1C` - `mvn -ntp dependency:tree -pl extensions-core/druid-pac4j -Dincludes=com.nimbusds:nimbus-jose-jwt -Pskip-static-checks -Dweb.console.skip=true -DskipTests` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
