I just want to add that there is a Spark Jira issue[1] for upgrading Netty once Arrow v13.0.0 is released this month.
[1] https://issues.apache.org/jira/projects/SPARK/issues/SPARK-44212 On Thu, Jul 6, 2023 at 2:25 PM Dane Pitkin <d...@voltrondata.com> wrote: > Hi all, > > The next release of Apache Arrow v13.0.0 coming this month[1] has upgraded > Netty to v4.1.94.Final[2] due to a moderate severity CVE[3]. We are seeing > that Spark using Netty v4.1.93.Final is not compatible with Arrow > v13.0.0, throwing an exception at runtime[4]. There has been some talk in a > Spark PR about upgrading to Netty v4.1.94.Final once the new > arrow-memory-netty is released[5]. > > Should the Spark POM be updated to shade arrow-memory-netty? > > Thanks, > Dane > > [1] https://lists.apache.org/thread/f9r0dsd65ohdtcvc7fnnlfs23n3z0n7f > [2] https://github.com/apache/arrow/pull/36211 > [3] https://github.com/advisories/GHSA-6mjq-h674-j845 > [4] https://github.com/apache/arrow/issues/36332 > [5] https://github.com/apache/spark/pull/41681 > >
