This is an automated email from the ASF dual-hosted git repository. xiangfu0 pushed a commit to branch release-1.6.0-rc in repository https://gitbox.apache.org/repos/asf/pinot.git
commit 3e6c0187b130e48efe45600f3a9037df49c65e1d Author: Dylan Dreyer <[email protected]> AuthorDate: Tue Oct 13 14:30:57 2026 -0700 Strip hadoop-client-runtime's relocated jline 3.9.0 from shaded plugin jars (#926) hadoop-client-runtime (every release through 3.5.0) bundles a relocated jline 3.9.0 under org.apache.hadoop.shaded.org.jline for Hadoop's interactive CLIs. Nothing else in the uber-jar references it, but its jline-* Maven metadata makes scanners flag jline-builtins and jline-remote-telnet 3.9.0 CVEs in pinot-parquet. Strip it with the existing hadoop-client-runtime shade filter, the same way the relocated Jetty is removed. Co-authored-by: Claude Opus 5.5 <[email protected]> --- pom.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pom.xml b/pom.xml index 40b21aeeeaa..6caa4563ae2 100644 --- a/pom.xml +++ b/pom.xml @@ -2976,6 +2976,12 @@ <exclude>META-INF/maven/org.eclipse.jetty.websocket/**</exclude> <!-- ServiceLoader entries whose implementation classes are removed above. --> <exclude>META-INF/services/org.apache.hadoop.shaded.org.eclipse.jetty.**</exclude> + <!-- The uber-jar also bundles a relocated jline 3.9.0 (org.apache.hadoop.shaded.org.jline), used + only by Hadoop's interactive CLIs; nothing else in the uber-jar references it. Its jline-* + Maven metadata makes scanners flag jline-builtins / jline-remote-telnet 3.9.0 CVEs. --> + <exclude>org/apache/hadoop/shaded/org/jline/**</exclude> + <exclude>META-INF/maven/org.jline/**</exclude> + <exclude>META-INF/services/org.apache.hadoop.shaded.org.jline.**</exclude> </excludes> </filter> </filters> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
