Martijn Visser created FLINK-41021:
--------------------------------------
Summary: Update commons-beanutils to 1.11.0 and jsoup to 1.23.2
Key: FLINK-41021
URL: https://issues.apache.org/jira/browse/FLINK-41021
Project: Flink
Issue Type: Technical Debt
Components: Build System, FileSystems
Reporter: Martijn Visser
Assignee: Martijn Visser
Fix For: 2.4.0
commons-beanutils 1.9.4, which flink-s3-fs-hadoop and flink-s3-fs-presto
bundle, is affected by CVE-2025-48734, and the jsoup version used by flink-docs
tests has open advisories too.
We should update commons-beanutils to 1.11.0 in all three modules that pin it
(flink-fs-hadoop-shaded and both S3 file systems) and in their NOTICE files,
and jsoup to 1.23.2. The open Dependabot PR only bumps flink-fs-hadoop-shaded,
which leaves the S3 jars on 1.9.4.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
