This is an automated email from the ASF dual-hosted git repository.
Fly-Style pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 2a6a00adc45 fix: resolve CVE-2026-110879, CVE-2026-104895 (#20852)
2a6a00adc45 is described below
commit 2a6a00adc45e1da4d9a5ff42d6db457d0689715e
Author: Sasha Syrotenko <[email protected]>
AuthorDate: Thu Nov 5 16:57:09 2026 +0200
fix: resolve CVE-2026-110879, CVE-2026-104895 (#20852)
* fix: resolve CVE-2026-118042, CVE-2026-110879, CVE-2026-104895
* Update shaded guava version
---
extensions-contrib/opentelemetry-emitter/pom.xml | 2 +-
licenses.yaml | 20 ++++++++++----------
owasp-dependency-check-suppressions.xml | 4 ++--
pom.xml | 6 +++---
4 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/extensions-contrib/opentelemetry-emitter/pom.xml
b/extensions-contrib/opentelemetry-emitter/pom.xml
index 5395aa29de3..6abdc10648e 100644
--- a/extensions-contrib/opentelemetry-emitter/pom.xml
+++ b/extensions-contrib/opentelemetry-emitter/pom.xml
@@ -38,7 +38,7 @@
<opentelemetry.instrumentation.version>2.32.0-alpha</opentelemetry.instrumentation.version>
<!-- These guava and grpc versions are used only in the
opentelemetry-extension.
Look at build section for more details about shading. -->
- <shade.guava.version>33.7.2-jre</shade.guava.version>
+ <shade.guava.version>${guava.version}</shade.guava.version>
<shade.grpc.version>1.84.3</shade.grpc.version>
</properties>
<dependencyManagement>
diff --git a/licenses.yaml b/licenses.yaml
index 4a0c1596048..8310b31f191 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -355,7 +355,7 @@ name: Jackson
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 2.22.3
+version: 2.22.4
libraries:
- com.fasterxml.jackson.core: jackson-core
- com.fasterxml.jackson.core: jackson-databind
@@ -408,7 +408,7 @@ name: Jackson
license_category: binary
module: extensions-contrib/druid-deltalake-extensions
license_name: Apache License version 2.0
-version: 2.22.3
+version: 2.22.4
libraries:
- com.fasterxml.jackson.core: jackson-databind
notice: |
@@ -468,7 +468,7 @@ name: Error Prone Annotations
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 2.50.0
+version: 2.52.0
libraries:
- com.google.errorprone: error_prone_annotations
@@ -498,7 +498,7 @@ name: Guava
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 33.7.2-jre
+version: 33.8.0-jre
libraries:
- com.google.guava: guava
@@ -1136,7 +1136,7 @@ name: Jackson
license_category: binary
module: extensions/druid-kubernetes-overlord-extensions
license_name: Apache License version 2.0
-version: 2.22.3
+version: 2.22.4
libraries:
- com.fasterxml.jackson.dataformat: jackson-dataformat-properties
notice: |
@@ -2876,7 +2876,7 @@ libraries:
---
name: Jackson Dataformat Yaml
-version: 2.22.3
+version: 2.22.4
license_category: binary
module: extensions/druid-avro-extensions
license_name: Apache License version 2.0
@@ -2886,7 +2886,7 @@ libraries:
---
name: Jackson Dataformat Yaml
-version: 2.22.3
+version: 2.22.4
license_category: binary
module: extensions/druid-protobuf-extensions
license_name: Apache License version 2.0
@@ -2899,7 +2899,7 @@ name: Jackson
license_category: binary
module: extensions/druid-kubernetes-extensions
license_name: Apache License version 2.0
-version: 2.22.3
+version: 2.22.4
libraries:
- com.fasterxml.jackson.dataformat: jackson-dataformat-cbor
notice: |
@@ -2930,7 +2930,7 @@ name: Jackson
license_category: binary
module: extensions/druid-azure-extensions
license_name: Apache License version 2.0
-version: 2.22.3
+version: 2.22.4
libraries:
- com.fasterxml.jackson.datatype: jackson-datatype-jsr310
notice: |
@@ -7660,7 +7660,7 @@ libraries:
---
name: Jackson Datatype JDK8
-version: 2.22.3
+version: 2.22.4
license_category: binary
module: extensions/druid-protobuf-extensions
license_name: Apache License version 2.0
diff --git a/owasp-dependency-check-suppressions.xml
b/owasp-dependency-check-suppressions.xml
index 8fd89c5f754..885eb5fa98e 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -842,7 +842,7 @@
<suppress>
<!-- CVE-2026-89407, CVE-2026-89425: ReDoS/OOM in jackson-core's number
and error-token parsing
of malformed input. Affects jackson-core shaded inside
hadoop-client-runtime-3.5.0.jar
- and parquet-jackson-1.18.1.jar, not Druid's own jackson-core
(2.22.3). -->
+ and parquet-jackson-1.18.1.jar, not Druid's own jackson-core
(2.22.4). -->
<notes><![CDATA[
file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-core 2.18.6)
parquet-jackson-1.18.1.jar (shaded jackson-core 2.22.2)
@@ -870,7 +870,7 @@
Each requires binding untrusted JSON into types that use these
annotations or field types.
Hadoop's client classes in hadoop-client-api reference none of these
annotations and read
JSON from cluster services (NameNode, KMS) as untyped maps. Druid's
own jackson-databind
- (2.22.3) is not affected. parquet-jackson's jackson-databind (2.22.2)
already has these fixes.
+ (2.22.4) is not affected. parquet-jackson's jackson-databind (2.22.2)
already has these fixes.
Remove when Hadoop ships jackson-databind 2.18.10+. -->
<notes><![CDATA[
file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
diff --git a/pom.xml b/pom.xml
index c65c9201d67..862ddedec00 100644
--- a/pom.xml
+++ b/pom.xml
@@ -97,11 +97,11 @@
<datasketches.memory.version>2.2.0</datasketches.memory.version>
<derby.version>10.17.1.0</derby.version>
<dropwizard.metrics.version>4.2.40</dropwizard.metrics.version>
- <errorprone.annotations.version>2.50.0</errorprone.annotations.version>
+ <errorprone.annotations.version>2.52.0</errorprone.annotations.version>
<errorprone.version>2.50.0</errorprone.version>
<fabric8.version>8.0.0</fabric8.version>
<fastutil.version>8.5.19</fastutil.version>
- <guava.version>33.7.2-jre</guava.version>
+ <guava.version>33.8.0-jre</guava.version>
<guice.version>6.0.0</guice.version>
<hamcrest.version>3.0</hamcrest.version>
<iceberg.core.version>1.12.0</iceberg.core.version>
@@ -109,7 +109,7 @@
<jetty.version>12.1.14</jetty.version>
<jspecify.version>1.0.1</jspecify.version>
<jersey.version>1.19.4</jersey.version>
- <jackson.version>2.22.3</jackson.version>
+ <jackson.version>2.22.4</jackson.version>
<codehaus.jackson.version>1.9.13</codehaus.jackson.version>
<log4j.version>2.26.1</log4j.version>
<mysql.version>26.7.0</mysql.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
