This is an automated email from the ASF dual-hosted git repository.
cryptoe pushed a commit to branch 39.0.0
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/39.0.0 by this push:
new fe47729714a Fix CVE-2026-111497 by bumping brotli version for orc to
1.24.0 explicitly (#20826) (#20827)
fe47729714a is described below
commit fe47729714a0bd8669c4112dcb0e68bd61cd2786
Author: Sasha Syrotenko <[email protected]>
AuthorDate: Tue Nov 3 19:40:22 2026 +0200
Fix CVE-2026-111497 by bumping brotli version for orc to 1.24.0 explicitly
(#20826) (#20827)
---
extensions-core/orc-extensions/pom.xml | 10 ++++++++++
licenses.yaml | 4 ++--
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/extensions-core/orc-extensions/pom.xml
b/extensions-core/orc-extensions/pom.xml
index fd2b652bb4e..10a67751d09 100644
--- a/extensions-core/orc-extensions/pom.xml
+++ b/extensions-core/orc-extensions/pom.xml
@@ -34,6 +34,16 @@
<hive-storage-api.version>4.2.0</hive-storage-api.version>
<orc.version>2.3.1</orc.version>
</properties>
+ <dependencyManagement>
+ <dependencies>
+ <!-- override the transitive dependency from orc-core 2.3.1 to
address CVE-2026-111497 -->
+ <dependency>
+ <groupId>com.aayushatharva.brotli4j</groupId>
+ <artifactId>brotli4j</artifactId>
+ <version>1.24.0</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
<dependencies>
<dependency>
<groupId>org.apache.druid</groupId>
diff --git a/licenses.yaml b/licenses.yaml
index e9a6e43d562..cf34416b8f8 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -3933,7 +3933,7 @@ name: Brotli4j
license_category: binary
module: extensions/druid-orc-extensions
license_name: Apache License version 2.0
-version: 1.20.0
+version: 1.24.0
libraries:
- com.aayushatharva.brotli4j: brotli4j
- com.aayushatharva.brotli4j: service
@@ -3975,7 +3975,7 @@ name: Google Brotli bundled by Brotli4j
license_category: binary
module: extensions/druid-orc-extensions
license_name: MIT License
-version: 1.1.0
+version: 1.2.1
copyright: 2009, 2010, 2013-2016 the Brotli Authors
license_file_path: licenses/bin/google-brotli.MIT
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
