Akanksha-kedia opened a new pull request, #6821: URL: https://github.com/apache/hive/pull/6821
parquet-hadoop-bundle shades its own copy of Jackson under `shaded.parquet.com.fasterxml.jackson.*`, independent of Hive's own `jackson.version` property. HIVE-30035 (merged) already moved `parquet.version` 1.16.0 -> 1.18.0, which bundles jackson-databind 2.22.1 — already clean of the CVE-2026-59888 range this ticket was filed against (vulnerable: `[2.15.0,2.18.8)`, `[2.19.0,2.21.4)`; 2.22.1 is past both). This takes the additional latest-patch step to 1.18.1 (bundles jackson-databind 2.22.2) for hygiene. ## Verified - `mvn dependency:tree` (org.apache.parquet:parquet-hadoop-bundle, com.fasterxml.jackson.core/datatype/dataformat) resolves cleanly. - `ql`, `iceberg/iceberg-catalog`, `iceberg/iceberg-handler` compile and install cleanly against 1.18.1. - `TestHiveSchemaConverter` (touched by HIVE-30035 for the 1.18.0 jump) passes: 30/30, 0 failures. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
