This is an automated email from the ASF dual-hosted git repository.
dongjoon-hyun pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 215a1460d9d4 [SPARK-60022][BUILD] Upgrade Netty to 4.2.19.Final
215a1460d9d4 is described below
commit 215a1460d9d4acdac6f72b42c28ab60b9ff5b7fe
Author: Dongjoon Hyun <[email protected]>
AuthorDate: Sat Oct 10 00:24:33 2026 +0100
[SPARK-60022][BUILD] Upgrade Netty to 4.2.19.Final
### What changes were proposed in this pull request?
This PR aims to upgrade Netty to 4.2.19.Final.
### Why are the changes needed?
To bring the latest security and bug fixes:
- https://netty.io/news/2026/10/06/4-2-19-Final.html
- https://github.com/netty/netty/releases/tag/netty-4.2.19.Final
(2026-10-06)
This release contains 16 security fixes, including the following in the
modules used by Spark:
- Improper CRLF neutralization and request/response smuggling in
`io.netty:netty-codec-http`
- Origin validation error and unbounded resource consumption in
`io.netty:netty-codec-http`
- Unbounded resource consumption in `io.netty:netty-codec-http2`,
`io.netty:netty-codec-base`, and `io.netty:netty-codec-dns`
- SNI routing bypass and improper access control in `io.netty:netty-handler`
- Input misinterpretation in `io.netty:netty-codec-socks`
It also contains the following bug fixes, among others:
- HTTP/2: Remove failed SETTINGS from ACK queue
- HTTP/2: Reserve promised stream before running the request verifier
- Guard `ChunkedWriteHandler.doFlush()` against re-entrant invocation from
user code
- Guard against out-of-bounds reads when parsing ClientHello SNI extension
- Release `Channel` when `SimpleChannelPool` acquire is cancelled
- Make `IoEventLoopGroup.isCompatible/isIoType` side-effect free
- `HttpUtil.getCharset()` must accept whitespace before the next
Content-Type parameter
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 5.5
Closes #59266 from dongjoon-hyun/SPARK-60022.
Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
---
dev/deps/spark-deps-hadoop-3-hive-2.3 | 46 +++++++++++++++++------------------
pom.xml | 2 +-
2 files changed, 24 insertions(+), 24 deletions(-)
diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3
b/dev/deps/spark-deps-hadoop-3-hive-2.3
index 50f978819c3d..9e94b7bf3c20 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -197,35 +197,35 @@ metrics-jmx/4.2.37//metrics-jmx-4.2.37.jar
metrics-json/4.2.37//metrics-json-4.2.37.jar
metrics-jvm/4.2.37//metrics-jvm-4.2.37.jar
minlog/1.3.0//minlog-1.3.0.jar
-netty-all/4.2.18.Final//netty-all-4.2.18.Final.jar
-netty-buffer/4.2.18.Final//netty-buffer-4.2.18.Final.jar
-netty-codec-base/4.2.18.Final//netty-codec-base-4.2.18.Final.jar
-netty-codec-compression/4.2.18.Final//netty-codec-compression-4.2.18.Final.jar
-netty-codec-dns/4.2.18.Final//netty-codec-dns-4.2.18.Final.jar
-netty-codec-http/4.2.18.Final//netty-codec-http-4.2.18.Final.jar
-netty-codec-http2/4.2.18.Final//netty-codec-http2-4.2.18.Final.jar
-netty-codec-socks/4.2.18.Final//netty-codec-socks-4.2.18.Final.jar
-netty-codec/4.2.18.Final//netty-codec-4.2.18.Final.jar
-netty-common/4.2.18.Final//netty-common-4.2.18.Final.jar
-netty-handler-proxy/4.2.18.Final//netty-handler-proxy-4.2.18.Final.jar
-netty-handler/4.2.18.Final//netty-handler-4.2.18.Final.jar
-netty-resolver-dns/4.2.18.Final//netty-resolver-dns-4.2.18.Final.jar
-netty-resolver/4.2.18.Final//netty-resolver-4.2.18.Final.jar
+netty-all/4.2.19.Final//netty-all-4.2.19.Final.jar
+netty-buffer/4.2.19.Final//netty-buffer-4.2.19.Final.jar
+netty-codec-base/4.2.19.Final//netty-codec-base-4.2.19.Final.jar
+netty-codec-compression/4.2.19.Final//netty-codec-compression-4.2.19.Final.jar
+netty-codec-dns/4.2.19.Final//netty-codec-dns-4.2.19.Final.jar
+netty-codec-http/4.2.19.Final//netty-codec-http-4.2.19.Final.jar
+netty-codec-http2/4.2.19.Final//netty-codec-http2-4.2.19.Final.jar
+netty-codec-socks/4.2.19.Final//netty-codec-socks-4.2.19.Final.jar
+netty-codec/4.2.19.Final//netty-codec-4.2.19.Final.jar
+netty-common/4.2.19.Final//netty-common-4.2.19.Final.jar
+netty-handler-proxy/4.2.19.Final//netty-handler-proxy-4.2.19.Final.jar
+netty-handler/4.2.19.Final//netty-handler-4.2.19.Final.jar
+netty-resolver-dns/4.2.19.Final//netty-resolver-dns-4.2.19.Final.jar
+netty-resolver/4.2.19.Final//netty-resolver-4.2.19.Final.jar
netty-tcnative-boringssl-static/2.0.84.Final/linux-aarch_64/netty-tcnative-boringssl-static-2.0.84.Final-linux-aarch_64.jar
netty-tcnative-boringssl-static/2.0.84.Final/linux-x86_64/netty-tcnative-boringssl-static-2.0.84.Final-linux-x86_64.jar
netty-tcnative-boringssl-static/2.0.84.Final/osx-aarch_64/netty-tcnative-boringssl-static-2.0.84.Final-osx-aarch_64.jar
netty-tcnative-boringssl-static/2.0.84.Final/osx-x86_64/netty-tcnative-boringssl-static-2.0.84.Final-osx-x86_64.jar
netty-tcnative-boringssl-static/2.0.84.Final/windows-x86_64/netty-tcnative-boringssl-static-2.0.84.Final-windows-x86_64.jar
netty-tcnative-classes/2.0.84.Final//netty-tcnative-classes-2.0.84.Final.jar
-netty-transport-classes-epoll/4.2.18.Final//netty-transport-classes-epoll-4.2.18.Final.jar
-netty-transport-classes-kqueue/4.2.18.Final//netty-transport-classes-kqueue-4.2.18.Final.jar
-netty-transport-native-epoll/4.2.18.Final/linux-aarch_64/netty-transport-native-epoll-4.2.18.Final-linux-aarch_64.jar
-netty-transport-native-epoll/4.2.18.Final/linux-riscv64/netty-transport-native-epoll-4.2.18.Final-linux-riscv64.jar
-netty-transport-native-epoll/4.2.18.Final/linux-x86_64/netty-transport-native-epoll-4.2.18.Final-linux-x86_64.jar
-netty-transport-native-kqueue/4.2.18.Final/osx-aarch_64/netty-transport-native-kqueue-4.2.18.Final-osx-aarch_64.jar
-netty-transport-native-kqueue/4.2.18.Final/osx-x86_64/netty-transport-native-kqueue-4.2.18.Final-osx-x86_64.jar
-netty-transport-native-unix-common/4.2.18.Final//netty-transport-native-unix-common-4.2.18.Final.jar
-netty-transport/4.2.18.Final//netty-transport-4.2.18.Final.jar
+netty-transport-classes-epoll/4.2.19.Final//netty-transport-classes-epoll-4.2.19.Final.jar
+netty-transport-classes-kqueue/4.2.19.Final//netty-transport-classes-kqueue-4.2.19.Final.jar
+netty-transport-native-epoll/4.2.19.Final/linux-aarch_64/netty-transport-native-epoll-4.2.19.Final-linux-aarch_64.jar
+netty-transport-native-epoll/4.2.19.Final/linux-riscv64/netty-transport-native-epoll-4.2.19.Final-linux-riscv64.jar
+netty-transport-native-epoll/4.2.19.Final/linux-x86_64/netty-transport-native-epoll-4.2.19.Final-linux-x86_64.jar
+netty-transport-native-kqueue/4.2.19.Final/osx-aarch_64/netty-transport-native-kqueue-4.2.19.Final-osx-aarch_64.jar
+netty-transport-native-kqueue/4.2.19.Final/osx-x86_64/netty-transport-native-kqueue-4.2.19.Final-osx-x86_64.jar
+netty-transport-native-unix-common/4.2.19.Final//netty-transport-native-unix-common-4.2.19.Final.jar
+netty-transport/4.2.19.Final//netty-transport-4.2.19.Final.jar
objenesis/3.6//objenesis-3.6.jar
opencsv/2.3//opencsv-2.3.jar
opentelemetry-api/1.49.0//opentelemetry-api-1.49.0.jar
diff --git a/pom.xml b/pom.xml
index da0530888357..052764358b61 100644
--- a/pom.xml
+++ b/pom.xml
@@ -222,7 +222,7 @@
SPARK-53327 workaround should be reverted.
-->
<datasketches.version>6.2.0</datasketches.version>
- <netty.version>4.2.18.Final</netty.version>
+ <netty.version>4.2.19.Final</netty.version>
<netty-tcnative.version>2.0.84.Final</netty-tcnative.version>
<icu4j.version>78.3</icu4j.version>
<junit.version>6.0.3</junit.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
