This is an automated email from the ASF dual-hosted git repository.
kevinjqliu pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg.git
The following commit(s) were added to refs/heads/main by this push:
new e17f482445 Build: Fix Guava CVE scan failures in GCP and Kafka (#18679)
e17f482445 is described below
commit e17f4824458948d1e53a6efea0000b0855c4d62a
Author: Manu Zhang <[email protected]>
AuthorDate: Thu Oct 29 08:06:51 2026 +0800
Build: Fix Guava CVE scan failures in GCP and Kafka (#18679)
Co-authored-by: Codex <[email protected]>
Co-authored-by: Copilot App <[email protected]>
Co-authored-by: Kevin Liu <[email protected]>
---
....trivyignore => kafka-connect-runtime.trivyignore.yaml} | 14 ++++++++++----
.github/workflows/cve-scan.yml | 2 +-
gcp-bundle/build.gradle | 3 +++
gcp-bundle/runtime-deps.txt | 2 +-
kafka-connect/kafka-connect-runtime/runtime-deps.txt | 2 +-
5 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/.github/trivyignore/kafka-connect-runtime.trivyignore
b/.github/trivyignore/kafka-connect-runtime.trivyignore.yaml
similarity index 82%
rename from .github/trivyignore/kafka-connect-runtime.trivyignore
rename to .github/trivyignore/kafka-connect-runtime.trivyignore.yaml
index be12318130..b68db957cb 100644
--- a/.github/trivyignore/kafka-connect-runtime.trivyignore
+++ b/.github/trivyignore/kafka-connect-runtime.trivyignore.yaml
@@ -24,11 +24,17 @@
# upgraded independently of Apache Parquet, and 1.18.1 still bundles
# vulnerable versions.
#
+vulnerabilities:
# jackson-databind CVEs shaded into parquet-jackson 1.18.1 (jackson 2.22.2),
# only fixed in jackson >= 2.18.11 / 2.21.7 / 2.22.3.
-CVE-2026-91776
-CVE-2026-91777
+- id: CVE-2026-91776
+- id: CVE-2026-91777
# jackson-core CVEs shaded into parquet-jackson 1.17.1, only fixed in jackson
# >= 2.18.11 / 2.21.7 / 2.22.3. Apache Parquet 1.18.1 still bundles 2.22.2.
-CVE-2026-89407
-CVE-2026-89425
+- id: CVE-2026-89407
+- id: CVE-2026-89425
+# guava CVE shaded into hadoop-shaded-guava 1.5.0 (guava 33.4.8), only fixed in
+# guava >= 33.7.2. No newer hadoop-shaded-guava release exists yet.
+- id: CVE-2026-102554
+ paths:
+ - "**/hadoop-shaded-guava-1.5.0.jar"
diff --git a/.github/workflows/cve-scan.yml b/.github/workflows/cve-scan.yml
index 3c07cf786e..7039982cc1 100644
--- a/.github/workflows/cve-scan.yml
+++ b/.github/workflows/cve-scan.yml
@@ -110,7 +110,7 @@ jobs:
:iceberg-kafka-connect:iceberg-kafka-connect-runtime:distZip
scan-path: kafka-connect/kafka-connect-runtime/build/distributions
unpack: true
- trivyignores: .github/trivyignore/kafka-connect-runtime.trivyignore
+ trivyignores:
.github/trivyignore/kafka-connect-runtime.trivyignore.yaml
- distribution: aws-bundle
build-task: :iceberg-aws-bundle:shadowJar
scan-path: aws-bundle/build/libs
diff --git a/gcp-bundle/build.gradle b/gcp-bundle/build.gradle
index 509aa01927..5073d0463c 100644
--- a/gcp-bundle/build.gradle
+++ b/gcp-bundle/build.gradle
@@ -35,6 +35,9 @@ project(":iceberg-gcp-bundle") {
// Align the shaded Jackson to the project version; the Google libraries
BOM
// otherwise pulls in an older jackson-databind with known CVEs.
implementation platform(libs.jackson.bom)
+ // Align the shaded Guava to the project version; the Google libraries BOM
+ // otherwise pulls in an older Guava with known CVEs.
+ implementation libs.guava.guava
implementation "com.google.cloud:google-cloud-storage"
implementation "com.google.cloud:google-cloud-bigquery"
implementation "com.google.cloud:google-cloud-core"
diff --git a/gcp-bundle/runtime-deps.txt b/gcp-bundle/runtime-deps.txt
index d54c138bc9..221c3f0f8f 100644
--- a/gcp-bundle/runtime-deps.txt
+++ b/gcp-bundle/runtime-deps.txt
@@ -49,7 +49,7 @@ com.google.code.gson:gson:2.14
com.google.errorprone:error_prone_annotations:2.50
com.google.flatbuffers:flatbuffers-java:24.3
com.google.guava:failureaccess:1.0
-com.google.guava:guava:33.6
+com.google.guava:guava:33.7
com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
com.google.http-client:google-http-client-apache-v2:2.2
com.google.http-client:google-http-client-appengine:2.2
diff --git a/kafka-connect/kafka-connect-runtime/runtime-deps.txt
b/kafka-connect/kafka-connect-runtime/runtime-deps.txt
index a856e44482..eaa9880eb9 100644
--- a/kafka-connect/kafka-connect-runtime/runtime-deps.txt
+++ b/kafka-connect/kafka-connect-runtime/runtime-deps.txt
@@ -61,7 +61,7 @@ com.google.code.gson:gson:2.14
com.google.errorprone:error_prone_annotations:2.50
com.google.flatbuffers:flatbuffers-java:24.3
com.google.guava:failureaccess:1.0
-com.google.guava:guava:33.6
+com.google.guava:guava:33.7
com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
com.google.http-client:google-http-client-apache-v2:2.2
com.google.http-client:google-http-client-appengine:2.2
