This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new b86760394c3 Fix dependency vulnerabilities in shaded plugins (#19807)
b86760394c3 is described below
commit b86760394c3bdc4e3ea805160781377975c8b5b4
Author: Xiang Fu <[email protected]>
AuthorDate: Sun Oct 11 18:21:05 2026 -0700
Fix dependency vulnerabilities in shaded plugins (#19807)
* Use managed Jackson in shaded Parquet plugins
Parquet embeds an older relocated Jackson copy which the Jackson BOM does
not replace. Remove those classes from shaded inputs and relocate Parquet
references to the managed Jackson namespace, including when consuming an
already shaded Pinot Parquet artifact.
Reproduction: package pinot-parquet on master and inspect its shaded JAR;
Parquet PackageVersion reports Jackson 2.22.2 alongside managed 2.22.3.
Validation: scoped package and three existing reader tests passed; packaged
metadata serialization and encryption JSON round trip passed with only the
shaded JAR on the classpath. JAR inspection shows no old Parquet Jackson
classes/references and Trivy reports no Jackson findings. Root formatting,
checkstyle and license checks passed.
* Remove unused Hadoop terminal classes from shaded artifacts
Hadoop bundles an older relocated JLine for the YARN interactive shell,
which Pinot does not use and already lacks its excluded Jetty dependencies.
Remove these classes, metadata and services while retaining managed CLI
JLine.
Reproduction: package pinot-parquet on master and inspect the shaded JAR;
Hadoop-shaded JLine 3.9.0 classes and metadata cause five Trivy findings.
Validation: scoped package and packaged Parquet metadata/encryption JSON
round trips passed; root formatting, checkstyle and license checks passed.
The JAR has no embedded Hadoop JLine classes/services/3.9.0 metadata and
retains canonical JLine 4.4.6.
* Fix Reactor Core and remove unused HTTP server code
Reproduction: packaged ADLS clients resolve affected Reactor Core timeout
operators and retain the HTTP server pipelining handler covered by
CVE-2026-47874. StarTree distributions copy this shaded plugin directly.
Manage fixed Reactor Core 3.8.7 and align the Netty 4.1-compatible client
transport. Remove unused HTTP server classes from direct and already shaded
inputs; retain client metadata. Scoped ADLS packaging, convergence, POM checks
and packaged client construction pass.
---
pom.xml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
diff --git a/pom.xml b/pom.xml
index e538ee0f621..be84e246d57 100644
--- a/pom.xml
+++ b/pom.xml
@@ -219,6 +219,8 @@
<log4j.version>2.26.1</log4j.version>
<slf4j.version>2.0.20</slf4j.version>
<netty.version>4.1.139.Final</netty.version>
+ <reactor-netty.version>1.2.18</reactor-netty.version>
+ <reactor-core.version>3.8.7</reactor-core.version>
<reactivestreams.version>1.0.4</reactivestreams.version>
<jts.version>1.20.0</jts.version>
<h3.version>4.5.0</h3.version>
@@ -807,6 +809,23 @@
<scope>import</scope>
</dependency>
+ <!-- Align Azure transports with the fixed Reactor Core release. -->
+ <dependency>
+ <groupId>io.projectreactor.netty</groupId>
+ <artifactId>reactor-netty-core</artifactId>
+ <version>${reactor-netty.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.projectreactor.netty</groupId>
+ <artifactId>reactor-netty-http</artifactId>
+ <version>${reactor-netty.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>io.projectreactor</groupId>
+ <artifactId>reactor-core</artifactId>
+ <version>${reactor-core.version}</version>
+ </dependency>
+
<dependency>
<groupId>org.reactivestreams</groupId>
<artifactId>reactive-streams</artifactId>
@@ -2960,10 +2979,32 @@
<!-- Solve NoClassDefFoundError. Borrowed from
https://github.com/prometheus/jmx_exporter/issues/802 -->
<exclude>META-INF/versions/9/org/yaml/snakeyaml/internal/**</exclude>
+ <!-- Use the managed Jackson dependencies for Parquet instead
of its embedded copy. -->
+ <exclude>shaded/parquet/com/fasterxml/jackson/**</exclude>
+
<exclude>META-INF/versions/**/shaded/parquet/com/fasterxml/jackson/**</exclude>
+
+ <!-- Azure storage uses only HTTP clients. Remove the unused
Reactor Netty HTTP server
+ and its vulnerable pipelining handler (CVE-2026-47874),
including already shaded inputs. -->
+ <exclude>reactor/netty/http/server/**</exclude>
+
<exclude>META-INF/versions/**/reactor/netty/http/server/**</exclude>
+
<!-- Exclude NettyInstance because it includes Netty package
literals -->
<exclude>src/main/java/org/apache/pinot/core/transport/NettyInstance.java</exclude>
</excludes>
</filter>
+ <filter>
+ <artifact>org.apache.parquet:parquet-jackson</artifact>
+ <excludes>
+ <exclude>META-INF/maven/com.fasterxml.jackson.core/**</exclude>
+ </excludes>
+ </filter>
+ <filter>
+ <!-- Also remove embedded Jackson metadata when consuming an
already shaded Parquet plugin. -->
+ <artifact>org.apache.pinot:pinot-parquet</artifact>
+ <excludes>
+ <exclude>META-INF/maven/com.fasterxml.jackson.core/**</exclude>
+ </excludes>
+ </filter>
<filter>
<!-- hadoop-client-runtime is a Hadoop uber-jar that bundles its
own relocated Jetty
(org.apache.hadoop.shaded.org.eclipse.jetty). It exists
only for Hadoop's embedded
@@ -2979,10 +3020,18 @@
<exclude>META-INF/maven/org.eclipse.jetty.websocket/**</exclude>
<!-- ServiceLoader entries whose implementation classes are
removed above. -->
<exclude>META-INF/services/org.apache.hadoop.shaded.org.eclipse.jetty.**</exclude>
+ <!-- JLine is used only by YARN's unused interactive shell. -->
+ <exclude>org/apache/hadoop/shaded/org/jline/**</exclude>
+ <exclude>META-INF/maven/org.jline/**</exclude>
+
<exclude>META-INF/services/org.apache.hadoop.shaded.org.jline.**</exclude>
</excludes>
</filter>
</filters>
<relocations>
+ <relocation>
+ <pattern>shaded.parquet.com.fasterxml.jackson</pattern>
+
<shadedPattern>${shade.prefix}.com.fasterxml.jackson</shadedPattern>
+ </relocation>
<relocation>
<pattern>com.fasterxml.jackson</pattern>
<shadedPattern>${shade.prefix}.com.fasterxml.jackson</shadedPattern>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
