This is an automated email from the ASF dual-hosted git repository. dianfu pushed a commit to branch 28983 in repository https://gitbox.apache.org/repos/asf/flink.git
commit ab5d84512cc1c0f7ded8b49077b1abe5140976e0 Author: Dian Fu <[email protected]> AuthorDate: Tue Aug 18 19:48:38 2026 +0800 relocate opentelemetry --- flink-python/pom.xml | 13 ++++++++++++- flink-python/src/main/resources/META-INF/NOTICE | 6 +++--- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/flink-python/pom.xml b/flink-python/pom.xml index 4ca2467a92e..ba9f5a44625 100644 --- a/flink-python/pom.xml +++ b/flink-python/pom.xml @@ -35,7 +35,7 @@ under the License. <packaging>jar</packaging> <properties> - <!-- Align with Beam ${beam.version} optional transitive. --> + <!-- Override Beam's optional transitive with a version that fixes CVE-2026-45292. --> <opentelemetry.bundled.version>1.62.0</opentelemetry.bundled.version> <arrow.version>19.0.0</arrow.version> @@ -751,6 +751,12 @@ under the License. org.apache.flink.api.python.shaded.com.fasterxml.jackson </shadedPattern> </relocation> + <relocation> + <pattern>io.opentelemetry</pattern> + <shadedPattern> + org.apache.flink.api.python.shaded.io.opentelemetry + </shadedPattern> + </relocation> <!-- Manually relocate multi-release classes to the correct shaded package. This is needed due to a bug in the Maven Shade plugin, which only relocates the content but not @@ -796,6 +802,11 @@ under the License. <shadedPattern>META-INF/versions/$1/org/apache/flink/api/python/shaded/io/netty/</shadedPattern> <rawString>true</rawString> </relocation> + <relocation> + <pattern>META-INF/versions/(\d+)/io/opentelemetry/</pattern> + <shadedPattern>META-INF/versions/$1/org/apache/flink/api/python/shaded/io/opentelemetry/</shadedPattern> + <rawString>true</rawString> + </relocation> <relocation> <pattern>META-INF/versions/(\d+)/com/google/flatbuffers/</pattern> <shadedPattern>META-INF/versions/$1/org/apache/flink/api/python/shaded/com/google/flatbuffers/</shadedPattern> diff --git a/flink-python/src/main/resources/META-INF/NOTICE b/flink-python/src/main/resources/META-INF/NOTICE index dc648aa9a32..ab0cdf0791d 100644 --- a/flink-python/src/main/resources/META-INF/NOTICE +++ b/flink-python/src/main/resources/META-INF/NOTICE @@ -12,9 +12,9 @@ This project bundles the following dependencies under the Apache Software Licens - com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.3 - com.google.flatbuffers:flatbuffers-java:25.2.10 - joda-time:joda-time:2.5 -- io.opentelemetry:opentelemetry-api:1.57.0 -- io.opentelemetry:opentelemetry-common:1.57.0 -- io.opentelemetry:opentelemetry-context:1.57.0 +- io.opentelemetry:opentelemetry-api:1.62.0 +- io.opentelemetry:opentelemetry-common:1.62.0 +- io.opentelemetry:opentelemetry-context:1.62.0 - org.apache.arrow:arrow-format:19.0.0 - org.apache.arrow:arrow-memory-core:19.0.0 - org.apache.arrow:arrow-memory-netty:19.0.0
