This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 4833f69693e fix: exclude vulnerable SnakeYAML from Cassandra storage
(#19806)
4833f69693e is described below
commit 4833f69693e83ef485921eda267b5c93ed364eaf
Author: Frank Chen <[email protected]>
AuthorDate: Tue Aug 4 10:13:20 2026 +0800
fix: exclude vulnerable SnakeYAML from Cassandra storage (#19806)
* Exclude SnakeYAML from Cassandra storage
* docs: explain Cassandra SnakeYAML exclusion
---
extensions-contrib/cassandra-storage/pom.xml | 21 ++++++---------------
1 file changed, 6 insertions(+), 15 deletions(-)
diff --git a/extensions-contrib/cassandra-storage/pom.xml
b/extensions-contrib/cassandra-storage/pom.xml
index 5cb4d71da02..f1a93f561da 100644
--- a/extensions-contrib/cassandra-storage/pom.xml
+++ b/extensions-contrib/cassandra-storage/pom.xml
@@ -33,21 +33,6 @@
<relativePath>../../pom.xml</relativePath>
</parent>
- <dependencyManagement>
- <dependencies>
- <!-- snakeyaml explicitly pinned to version 1.33 as it is
- a transitive dependency of:
- com.netflix.astyanax:astyanax:jar ->
g.apache.cassandra:cassandra-all:jar
- please remove this pin after the update of astyanax, see comment
below
- -->
- <dependency>
- <groupId>org.yaml</groupId>
- <artifactId>snakeyaml</artifactId>
- <version>1.33</version>
- </dependency>
- </dependencies>
- </dependencyManagement>
-
<dependencies>
<dependency>
<groupId>org.apache.druid</groupId>
@@ -129,6 +114,12 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
</exclusion>
+ <!-- Cassandra uses SnakeYAML only for unused server
configuration; exclude the vulnerable,
+ binary-incompatible transitive dependency rather than
upgrading it. -->
+ <exclusion>
+ <groupId>org.yaml</groupId>
+ <artifactId>snakeyaml</artifactId>
+ </exclusion>
<exclusion>
<groupId>com.github.stephenc.high-scale-lib</groupId>
<artifactId>high-scale-lib</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
