This is an automated email from the ASF dual-hosted git repository.
JingsongLi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/paimon.git
The following commit(s) were added to refs/heads/master by this push:
new 4e9991a6fa [fs] Force CVE-patched commons-lang3 and snappy-java in
hadoop-shaded-3.4 (#8935)
4e9991a6fa is described below
commit 4e9991a6fa96fabbd2783332868d971ba0845858
Author: Eunbin Son <[email protected]>
AuthorDate: Fri Jul 31 00:03:23 2026 +0900
[fs] Force CVE-patched commons-lang3 and snappy-java in hadoop-shaded-3.4
(#8935)
---
paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml | 12 ++++++++++++
.../src/main/resources/META-INF/NOTICE | 2 +-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
b/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
index 0a042cd4e1..94749f888c 100644
--- a/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
+++ b/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
@@ -44,6 +44,18 @@
<artifactId>commons-beanutils</artifactId>
<version>${commons.beanutils.version}</version>
</dependency>
+ <dependency>
+ <!-- Bumped for security purposes (CVE-2025-48924); aligns
bundled version with NOTICE -->
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <version>3.18.0</version>
+ </dependency>
+ <dependency>
+ <!-- Bumped for security purposes; aligns bundled version with
NOTICE -->
+ <groupId>org.xerial.snappy</groupId>
+ <artifactId>snappy-java</artifactId>
+ <version>${snappy.version}</version>
+ </dependency>
</dependencies>
</dependencyManagement>
diff --git
a/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
b/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
index ba61822fd8..814ba28142 100644
---
a/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
+++
b/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
@@ -20,7 +20,7 @@ This project bundles the following dependencies under the
Apache Software Licens
- commons-logging:commons-logging:1.1.3
- org.apache.commons:commons-compress:1.21
- org.apache.commons:commons-configuration2:2.1.1
-- org.apache.commons:commons-lang3:3.12.0
+- org.apache.commons:commons-lang3:3.18.0
- org.apache.commons:commons-text:1.4
- org.apache.hadoop.thirdparty:hadoop-shaded-guava:1.4.0
- org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25:1.4.0
