xiangfu0 opened a new pull request, #19890: URL: https://github.com/apache/pinot/pull/19890
Hadoop and Curator bundle older Guava implementations inside their jars, so upgrading Pinot's managed Guava version alone leaves CVE-2026-102554 in shaded plugins. Use the managed Guava 33.7.2 copy by excluding the four embedded class namespaces and relocating their callers to Pinot's existing Guava namespace. Remove the accompanying embedded Maven metadata from Hadoop and already shaded Pinot artifacts, plus the stale versioned module descriptor bundled by Hadoop. ### Reproduction On master before this change, build `pinot-parquet` or `pinot-orc` with `./mvnw -pl pinot-plugins/pinot-input-format/pinot-parquet -am -DskipTests package`. The shaded jar still contains Guava classes under Hadoop's thirdparty/shaded namespaces and Curator's shaded namespace. Hadoop's embedded Guava Maven metadata reports 33.4.8-jre, although Pinot already manages 33.7.2-jre. The [Guava advisory](https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94) identifies 33.7.2 as the patched release. ### Validation - Root-only `spotless:apply`, `license:format`, `checkstyle:check`, and `license:check` passed. - Built Parquet, ORC, and HDFS with dependencies and compiler warning flags; the existing `ParquetRecordReaderTest`, `ORCRecordReaderTest`, and `HadoopPinotFSTest` passed: 25 tests, zero failures/errors/skips. - Inspected the resulting shaded common, Parquet, and ORC jars: all four embedded Guava class namespaces are absent; each contains the managed Guava implementation and Maven metadata for 33.7.2-jre. HDFS keeps its existing provided Hadoop dependency. - Manually wrote 100 Parquet records and verified every value with both Avro and native readers using only the rebuilt shaded Parquet/common jars. Both Hadoop and Guava loaded from the rebuilt Parquet jar. - Checked Hadoop/Curator class, method, and field references against the managed Guava/failureaccess APIs; no missing references found. - Repackaged ORC after removing Hadoop's stale Guava module descriptor; verified that the old 33.4.8 module version is absent and all 1,962 canonical Guava class bytes are unchanged. Reused the passing tests and packaged read/write evidence for this metadata-only follow-up. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
