We've just made a new release of the Apache HBase Thirdparty project. This project is used by the Apache HBase project to encapsulate a number of core dependencies that HBase relies upon ensuring that they are properly isolated from HBase downstream users, e.g. Google Protocol Buffers, Google Guava, and a few others.
4.1.9 is a regular release with some dependencies update. We bump protobuf-java to 4.28.2 for addressing CVE-2024-7254. The release is available as source at https://downloads.apache.org/[1] and as artifacts up in Maven central[2]. Release notes and Changes can be found at [1]. The release was tagged rel/4.1.9. All artifacts are signed with my key 9AD2AE49 which can be found here: https://downloads.apache.org/hbase/KEYS - Your Release Manager [1] https://downloads.apache.org/hbase/hbase-thirdparty-4.1.9 [2] https://repository.apache.org/service/local/repositories/releases/content/org/apache/hbase/thirdparty/hbase-thirdparty/4.1.9/
