This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new 55afab92fe1 Use managed Guava and Jackson instead of embedded
vulnerable copies (#19890)
55afab92fe1 is described below
commit 55afab92fe165cf222c9074084bf570a0d6ad290
Author: Xiang Fu <[email protected]>
AuthorDate: Fri Oct 16 14:32:42 2026 -0700
Use managed Guava and Jackson instead of embedded vulnerable copies (#19890)
* Use managed Guava instead of embedded Hadoop and Curator copies
* Remove stale Guava module metadata embedded by Hadoop
* Use managed Guava instead of the embedded Iceberg copy
* Use managed Guava for Pulsar and JDBC embedded copies
* Use managed Jackson instead of embedded dependency copies
---
pinot-plugins/pinot-file-system/pinot-s3/pom.xml | 4 +
.../pinot-stream-ingestion/pinot-pulsar/pom.xml | 4 +
pom.xml | 111 +++++++++++++++++++++
3 files changed, 119 insertions(+)
diff --git a/pinot-plugins/pinot-file-system/pinot-s3/pom.xml
b/pinot-plugins/pinot-file-system/pinot-s3/pom.xml
index 4fb57c927ab..156fdb6f553 100644
--- a/pinot-plugins/pinot-file-system/pinot-s3/pom.xml
+++ b/pinot-plugins/pinot-file-system/pinot-s3/pom.xml
@@ -35,6 +35,10 @@
</properties>
<dependencies>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-core</artifactId>
+ </dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>s3</artifactId>
diff --git a/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml
b/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml
index 239fa283465..9054308a038 100644
--- a/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml
+++ b/pinot-plugins/pinot-stream-ingestion/pinot-pulsar/pom.xml
@@ -41,6 +41,10 @@
<groupId>org.apache.pulsar</groupId>
<artifactId>pulsar-client-all</artifactId>
</dependency>
+ <dependency>
+ <groupId>com.google.guava</groupId>
+ <artifactId>guava</artifactId>
+ </dependency>
<!-- Pulsar declares these with runtime scope, which takes precedence over
the provided scope inherited through
pinot-spi and removes them from the compile classpath -->
<dependency>
diff --git a/pom.xml b/pom.xml
index a060fe76469..eb80fe50f10 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2977,6 +2977,39 @@
<exclude>shaded/parquet/com/fasterxml/jackson/**</exclude>
<exclude>META-INF/versions/**/shaded/parquet/com/fasterxml/jackson/**</exclude>
+ <!-- Keep Hadoop's shaded JAX-RS providers while using managed
Jackson core and databind. -->
+
<exclude>org/apache/hadoop/shaded/com/fasterxml/jackson/core/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/hadoop/shaded/com/fasterxml/jackson/core/**</exclude>
+
<exclude>org/apache/hadoop/shaded/com/fasterxml/jackson/databind/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/hadoop/shaded/com/fasterxml/jackson/databind/**</exclude>
+
<exclude>org/apache/hadoop/shaded/com/fasterxml/jackson/annotation/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/hadoop/shaded/com/fasterxml/jackson/annotation/**</exclude>
+ <exclude>com/facebook/presto/jdbc/internal/jackson/**</exclude>
+
<exclude>META-INF/versions/**/com/facebook/presto/jdbc/internal/jackson/**</exclude>
+
<exclude>software/amazon/awssdk/thirdparty/jackson/core/**</exclude>
+
<exclude>META-INF/versions/**/software/amazon/awssdk/thirdparty/jackson/core/**</exclude>
+ <!-- Presto's canonical Jackson Joda module must see canonical
Joda-Time values. -->
+
<exclude>com/facebook/presto/jdbc/internal/joda/time/**</exclude>
+
<exclude>META-INF/versions/**/com/facebook/presto/jdbc/internal/joda/time/**</exclude>
+
+ <!-- Use managed Guava instead of copies embedded in
dependencies. -->
+
<exclude>org/apache/hadoop/thirdparty/com/google/common/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/hadoop/thirdparty/com/google/common/**</exclude>
+
<exclude>org/apache/hadoop/shaded/com/google/common/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/hadoop/shaded/com/google/common/**</exclude>
+
<exclude>org/apache/hadoop/shaded/org/apache/curator/shaded/com/google/common/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/hadoop/shaded/org/apache/curator/shaded/com/google/common/**</exclude>
+
<exclude>org/apache/curator/shaded/com/google/common/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/curator/shaded/com/google/common/**</exclude>
+
<exclude>org/apache/iceberg/relocated/com/google/common/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/iceberg/relocated/com/google/common/**</exclude>
+ <exclude>org/apache/pulsar/shade/com/google/common/**</exclude>
+
<exclude>META-INF/versions/**/org/apache/pulsar/shade/com/google/common/**</exclude>
+ <exclude>com/facebook/presto/jdbc/internal/guava/**</exclude>
+
<exclude>META-INF/versions/**/com/facebook/presto/jdbc/internal/guava/**</exclude>
+
<exclude>net/snowflake/client/jdbc/internal/google/common/**</exclude>
+
<exclude>META-INF/versions/**/net/snowflake/client/jdbc/internal/google/common/**</exclude>
+
<!-- Azure storage uses only HTTP clients. Remove the unused
Reactor Netty HTTP server
and its vulnerable pipelining handler (CVE-2026-47874),
including already shaded inputs. -->
<exclude>reactor/netty/http/server/**</exclude>
@@ -2999,6 +3032,28 @@
<exclude>META-INF/maven/com.fasterxml.jackson.core/**</exclude>
</excludes>
</filter>
+ <filter>
+ <artifact>org.apache.hadoop*:*</artifact>
+ <excludes>
+ <exclude>META-INF/maven/com.google.guava/**</exclude>
+ <exclude>META-INF/maven/com.fasterxml.jackson.core/**</exclude>
+ <exclude>META-INF/versions/**/module-info.class</exclude>
+ </excludes>
+ </filter>
+ <filter>
+ <artifact>org.apache.iceberg:iceberg-bundled-guava</artifact>
+ <excludes>
+ <exclude>META-INF/maven/com.google.guava/**</exclude>
+ <exclude>META-INF/versions/**/module-info.class</exclude>
+ </excludes>
+ </filter>
+ <filter>
+ <!-- Already shaded plugins can also carry embedded Guava
metadata. -->
+ <artifact>org.apache.pinot:*</artifact>
+ <excludes>
+ <exclude>META-INF/maven/com.google.guava/**</exclude>
+ </excludes>
+ </filter>
<filter>
<!-- hadoop-client-runtime is a Hadoop uber-jar that bundles its
own relocated Jetty
(org.apache.hadoop.shaded.org.eclipse.jetty). It exists
only for Hadoop's embedded
@@ -3022,6 +3077,30 @@
</filter>
</filters>
<relocations>
+ <relocation>
+
<pattern>org.apache.hadoop.shaded.com.fasterxml.jackson.core</pattern>
+
<shadedPattern>${shade.prefix}.com.fasterxml.jackson.core</shadedPattern>
+ </relocation>
+ <relocation>
+
<pattern>org.apache.hadoop.shaded.com.fasterxml.jackson.databind</pattern>
+
<shadedPattern>${shade.prefix}.com.fasterxml.jackson.databind</shadedPattern>
+ </relocation>
+ <relocation>
+
<pattern>org.apache.hadoop.shaded.com.fasterxml.jackson.annotation</pattern>
+
<shadedPattern>${shade.prefix}.com.fasterxml.jackson.annotation</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>com.facebook.presto.jdbc.internal.jackson</pattern>
+
<shadedPattern>${shade.prefix}.com.fasterxml.jackson</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>software.amazon.awssdk.thirdparty.jackson.core</pattern>
+
<shadedPattern>${shade.prefix}.com.fasterxml.jackson.core</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>com.facebook.presto.jdbc.internal.joda.time</pattern>
+ <shadedPattern>org.joda.time</shadedPattern>
+ </relocation>
<relocation>
<pattern>shaded.parquet.com.fasterxml.jackson</pattern>
<shadedPattern>${shade.prefix}.com.fasterxml.jackson</shadedPattern>
@@ -3030,6 +3109,38 @@
<pattern>com.fasterxml.jackson</pattern>
<shadedPattern>${shade.prefix}.com.fasterxml.jackson</shadedPattern>
</relocation>
+ <relocation>
+ <pattern>org.apache.hadoop.thirdparty.com.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>org.apache.hadoop.shaded.com.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+
<pattern>org.apache.hadoop.shaded.org.apache.curator.shaded.com.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>org.apache.curator.shaded.com.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>org.apache.iceberg.relocated.com.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>org.apache.pulsar.shade.com.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+ <pattern>com.facebook.presto.jdbc.internal.guava</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
+ <relocation>
+
<pattern>net.snowflake.client.jdbc.internal.google.common</pattern>
+ <shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
+ </relocation>
<relocation>
<pattern>com.google.common</pattern>
<shadedPattern>${shade.prefix}.com.google.common</shadedPattern>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
