[
https://issues.apache.org/jira/browse/FLINK-41021?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Martijn Visser resolved FLINK-41021.
------------------------------------
Resolution: Fixed
Fixed in apache/flink:master
[FLINK-41021][fs] Update commons-beanutils to 1.11.0
458ed943a95be08004707e60c3603e37a2b44f95
[FLINK-41021][docs] Update jsoup to 1.23.2
99c5866b0717ef20d67f243ba7a6486d5eb85a3d
> Update commons-beanutils to 1.11.0 and jsoup to 1.23.2
> ------------------------------------------------------
>
> Key: FLINK-41021
> URL: https://issues.apache.org/jira/browse/FLINK-41021
> Project: Flink
> Issue Type: Technical Debt
> Components: Build System, FileSystems
> Reporter: Martijn Visser
> Assignee: Martijn Visser
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.4.0
>
>
> commons-beanutils 1.9.4, which flink-s3-fs-hadoop and flink-s3-fs-presto
> bundle, is affected by CVE-2025-48734, and the jsoup version used by
> flink-docs tests has open advisories too.
> We should update commons-beanutils to 1.11.0 in all three modules that pin it
> (flink-fs-hadoop-shaded and both S3 file systems) and in their NOTICE files,
> and jsoup to 1.23.2. The open Dependabot PR only bumps
> flink-fs-hadoop-shaded, which leaves the S3 jars on 1.9.4.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
