[
https://issues.apache.org/jira/browse/FLINK-41021?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated FLINK-41021:
-----------------------------------
Labels: pull-request-available (was: )
> Update commons-beanutils to 1.11.0 and jsoup to 1.23.2
> ------------------------------------------------------
>
> Key: FLINK-41021
> URL: https://issues.apache.org/jira/browse/FLINK-41021
> Project: Flink
> Issue Type: Technical Debt
> Components: Build System, FileSystems
> Reporter: Martijn Visser
> Assignee: Martijn Visser
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.4.0
>
>
> commons-beanutils 1.9.4, which flink-s3-fs-hadoop and flink-s3-fs-presto
> bundle, is affected by CVE-2025-48734, and the jsoup version used by
> flink-docs tests has open advisories too.
> We should update commons-beanutils to 1.11.0 in all three modules that pin it
> (flink-fs-hadoop-shaded and both S3 file systems) and in their NOTICE files,
> and jsoup to 1.23.2. The open Dependabot PR only bumps
> flink-fs-hadoop-shaded, which leaves the S3 jars on 1.9.4.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
