This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 36bec2f0824 ci: bump org.apache.kafka:kafka-clients from 4.3.1 to
4.4.0 (#20657)
36bec2f0824 is described below
commit 36bec2f08249ac989b5167001b37b1d001ad694a
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Thu Oct 29 20:33:31 2026 +0800
ci: bump org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0 (#20657)
* ci: bump org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0
Bumps org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0.
---
updated-dependencies:
- dependency-name: org.apache.kafka:kafka-clients
dependency-version: 4.4.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected]>
* build: align zstd-jni with Kafka clients
* build: update dependency license metadata
* build: drop zstd-jni Dependabot pin now that zstd-jni is upgraded
kafka-clients 4.4.0 requires zstd-jni 1.5.7-17. Upgrading drops decoding
of legacy (pre-1.0) zstd frames, so the pin that held zstd-jni below
1.5.7-13 no longer applies.
* build: remove zstd-jni CVE suppression
CVE-2026-87823 and CVE-2026-87795 are fixed in zstd-jni 1.5.7-14, and the
suppression only matched 1.5.7-11.
---------
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Frank Chen <[email protected]>
---
.github/dependabot.yml | 6 ------
licenses.yaml | 6 +++---
owasp-dependency-check-suppressions.xml | 15 ---------------
pom.xml | 4 ++--
4 files changed, 5 insertions(+), 26 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 988025ad9d4..718a85febce 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -23,13 +23,7 @@ updates:
applies-to: security-updates
patterns:
- "*"
- # zstd-jni fixes need manual review (see its ignore entry), so they
must not hold up the other security updates.
- exclude-patterns:
- - "com.github.luben:zstd-jni"
ignore:
- # zstd-jni 1.5.7-13 and later cannot decode legacy (pre-1.0) zstd frames
in .zst batch input.
- # Version updates are ignored; security updates still open PRs.
- - dependency-name: "com.github.luben:zstd-jni"
# skip AWS SDK v2 patch releases, which ship almost daily; minor bumps
still come through
- dependency-name: "software.amazon.awssdk:*"
update-types: ["version-update:semver-patch"]
diff --git a/licenses.yaml b/licenses.yaml
index a10afa00353..8c91cc5d8a5 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -3459,7 +3459,7 @@ notices:
---
name: Apache Kafka
-version: 4.3.1
+version: 4.4.0
license_category: binary
module: extensions/druid-kafka-indexing-service
license_name: Apache License version 2.0
@@ -3647,7 +3647,7 @@ name: JNI binding for Zstd
license_category: binary
module: java-core
license_name: BSD-2-Clause License
-version: 1.5.7-11
+version: 1.5.7-17
copyright: Luben Karavelov
license_file_path: licenses/bin/zstd-jni.BSD2
libraries:
@@ -4664,7 +4664,7 @@ name: Apache Kafka
license_category: binary
module: extensions/druid-kafka-extraction-namespace
license_name: Apache License version 2.0
-version: 4.3.1
+version: 4.4.0
libraries:
- org.apache.kafka: kafka-clients
notices:
diff --git a/owasp-dependency-check-suppressions.xml
b/owasp-dependency-check-suppressions.xml
index 8ed1acd1101..37ad2867566 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -963,21 +963,6 @@
<cve>CVE-2026-54428</cve>
</suppress>
- <suppress>
- <!-- CVE-2026-87823: Out-of-bounds memory read in ByteBuffer frame-size
methods via negative offset values.
- CVE-2026-87795: Out-of-bounds memory read in ZstdDictCompress
constructor via unvalidated offset/length.
- Both are fixed in zstd-jni 1.5.7-14. Suppressed until zstd-jni is
upgraded.
- Based on the analysis in
https://github.com/apache/druid/pull/20236#issuecomment-5646494509,
- this vulnerability should not affect Druid since the relevant code
paths do not get activated
- -->
- <notes><![CDATA[
- file name: zstd-jni-1.5.7-11.jar
- ]]></notes>
- <packageUrl
regex="true">^pkg:maven/com\.github\.luben/zstd-jni@1\.5\.7\-11$</packageUrl>
- <cve>CVE-2026-87823</cve>
- <cve>CVE-2026-87795</cve>
- </suppress>
-
<suppress>
<!-- CVE-2026-90559/93452: OOB read/write in
Snappy.uncompress/compress(ByteBuffer, ByteBuffer).
CVE-2026-108106: unbounded memory allocation during decompression
(fixed in 1.1.10.9).
diff --git a/pom.xml b/pom.xml
index df5656379be..1455bb0b1a7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -75,7 +75,7 @@
<project.build.resourceEncoding>UTF-8</project.build.resourceEncoding>
<maven.resolver.version>2.0.24</maven.resolver.version>
<apache.curator.version>5.9.0</apache.curator.version>
- <apache.kafka.version>4.3.1</apache.kafka.version>
+ <apache.kafka.version>4.4.0</apache.kafka.version>
<!-- when updating apache ranger, verify the usage of aws-bundle-sdk
vs aws-logs-sdk
and update as needed in
extensions-contrib/druid-ranger-security/pom.xml -->
<apache.ranger.version>2.9.0</apache.ranger.version>
@@ -731,7 +731,7 @@
<dependency>
<groupId>com.github.luben</groupId>
<artifactId>zstd-jni</artifactId>
- <version>1.5.7-11</version>
+ <version>1.5.7-17</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
