We've just made a new release of the Apache HBase Thirdparty project. This project is used by the Apache HBase project to encapsulate a number of core dependencies that HBase relies upon ensuring that they are properly isolated from HBase downstream users, e.g. Google Protocol Buffers, Google Guava, and a few others.
4.1.11 is a regular release with some dependencies update. We bumped netty to 4.1.121.Final for addressing CVE-2025-24970 <https://nvd.nist.gov/vuln/detail/CVE-2025-24970>. The release is available as source at https://downloads.apache.org/[1] <https://downloads.apache.org/hbase/hbase-thirdparty-4.1.11/> and as artifacts up in Maven central[2]. Release notes and Changes can be found at [1]. The release was tagged rel/4.1.11 <https://github.com/apache/hbase-thirdparty/releases/tag/rel%2F4.1.11> All artifacts are signed with my key 0x0FD0DA53 which can be found here: https://downloads.apache.org/hbase/KEYS - Your Release Manager [1] https://downloads.apache.org/hbase/hbase-thirdparty-4.1.11 [2] https://repository.apache.org/service/local/repositories/releases/content/org/apache/hbase/thirdparty/hbase-thirdparty/4.1.11/
