This is an automated email from the ASF dual-hosted git repository.
gianm pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 0bce210c62d Fix CVE-2026-111497 by bumping brotli version for orc to
1.24.0 explicitly (#20826)
0bce210c62d is described below
commit 0bce210c62d51220e6b095513d8e5d1929c368b7
Author: Sasha Syrotenko <[email protected]>
AuthorDate: Tue Nov 3 17:26:43 2026 +0200
Fix CVE-2026-111497 by bumping brotli version for orc to 1.24.0 explicitly
(#20826)
---
extensions-core/orc-extensions/pom.xml | 10 ++++++++++
licenses.yaml | 4 ++--
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/extensions-core/orc-extensions/pom.xml
b/extensions-core/orc-extensions/pom.xml
index f1e3e78d7be..bbe5a688e2b 100644
--- a/extensions-core/orc-extensions/pom.xml
+++ b/extensions-core/orc-extensions/pom.xml
@@ -34,6 +34,16 @@
<hive-storage-api.version>4.2.0</hive-storage-api.version>
<orc.version>2.3.1</orc.version>
</properties>
+ <dependencyManagement>
+ <dependencies>
+ <!-- override the transitive dependency from orc-core 2.3.1 to
address CVE-2026-111497 -->
+ <dependency>
+ <groupId>com.aayushatharva.brotli4j</groupId>
+ <artifactId>brotli4j</artifactId>
+ <version>1.24.0</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
<dependencies>
<dependency>
<groupId>org.apache.druid</groupId>
diff --git a/licenses.yaml b/licenses.yaml
index ea84a8066e1..4a0c1596048 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -4073,7 +4073,7 @@ name: Brotli4j
license_category: binary
module: extensions/druid-orc-extensions
license_name: Apache License version 2.0
-version: 1.20.0
+version: 1.24.0
libraries:
- com.aayushatharva.brotli4j: brotli4j
- com.aayushatharva.brotli4j: service
@@ -4115,7 +4115,7 @@ name: Google Brotli bundled by Brotli4j
license_category: binary
module: extensions/druid-orc-extensions
license_name: MIT License
-version: 1.1.0
+version: 1.2.1
copyright: 2009, 2010, 2013-2016 the Brotli Authors
license_file_path: licenses/bin/google-brotli.MIT
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
