xiangfu0 opened a new pull request, #19889: URL: https://github.com/apache/pinot/pull/19889
Upgrade the managed `org.asynchttpclient:async-http-client` version from 3.0.13 to 3.0.14, the patched release for CVE-2026-107230, CVE-2026-107228, CVE-2026-107226, and CVE-2026-107227. This updates consumers such as the Java client without changing their APIs. ### Reproduction On master before this change, `./mvnw -pl pinot-clients/pinot-java-client -am dependency:tree -Dincludes=org.asynchttpclient:async-http-client` selects 3.0.13. Snyk reports [origin validation](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20571429), [authentication](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20571297), [protection mechanism](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20574185), and [denial of service](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20571381) vulnerabilities against that version. The [upstream 3.0.14 release](https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14) contains the fixes. ### Validation - Root-only `spotless:apply`, `license:format`, `checkstyle:check`, and `license:check` passed. - `./mvnw -pl pinot-clients/pinot-java-client -am -Dtest=JsonAsyncHttpPinotClientTransportTest,SslContextProviderTest,PinotAdminTransportTest -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.compiler.showDeprecation=true -Dmaven.compiler.showWarnings=true -Dcheckstyle.skip -Dspotless.check.skip -Dlicense.skip test` passed: 24 tests, zero failures/errors/skips. Surefire reports confirm the runtime classpath contains async-http-client 3.0.14. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
