Dear Parquet devs/users, In the light of the recent security concerns about the parquet-avro reflect feature (see CVE-2025-30065), a would like to start a discussion about its deprecation in the next minor parquet-java release, and the removal in the next major release.
The parquet-avro module [1] in parquet-java is to use the Avro data model for reading/writing Parquet data. The reflect feature is to support mapping Parquet data to arbitrary Java objects via reflection. The two additional mapping solutions (code generation and the generic API) would remain supported in parquet-java. Cheers, Gabor [1] https://github.com/apache/parquet-java/tree/master/parquet-avro
