manuzhang opened a new pull request, #18679: URL: https://github.com/apache/iceberg/pull/18679
CVE-2026-102554 blocks unrelated PRs such as [#18678](https://github.com/apache/iceberg/pull/18678) because the GCP BOM still selects Guava 33.6.0. Select the project's patched Guava explicitly in the GCP bundle; Kafka inherits that dependency. Hadoop's separate shaded copy cannot be upgraded independently and 1.5.0 has no patched successor, so restrict its Kafka exception to that exact jar. The YAML ignore file preserves the existing Parquet exceptions and continues reporting vulnerable Guava in other artifacts. Test plan: Rebuild GCP/Kafka distributions and scan with Trivy 0.69.3; verify a standalone old-Guava negative control still fails. Both scans, runtime-dependency checks, Spotless, Checkstyle, and 361 GCP/BigQuery/Kafka unit tests passed (28 skipped). Docker integration tests were unavailable; their sources compiled. --- **AI Disclosure** - Model: GPT-6 - Platform/Tool: Codex - Human Oversight: unreviewed - Prompt Summary: Generate the dependency alignment, runtime baselines, and artifact-scoped Trivy exception to fix the shared GCP/Kafka CI failures. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
