thswlsqls opened a new issue, #8933: URL: https://github.com/apache/paimon/issues/8933
**Search before asking** - [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar. **Paimon version** master @ 27f4656bb / 2.0-SNAPSHOT **Compute Engine** Engine-agnostic (filesystem shading) **Minimal reproduce step** `mvn -pl paimon-filesystems/paimon-hadoop-shaded-3.4 dependency:tree` resolves `commons-lang3:jar:3.17.0` and `snappy-java:jar:1.1.10.4`, both transitive from `hadoop-common:3.4.2`. The shade config includes `*:*` and relocates neither, so both land in the shaded jar under their original package names. **What doesn't meet your expectations?** commons-lang3 3.17.0 is affected by CVE-2025-48924, fixed in 3.18.0. #6781 raised seven filesystem NOTICE files to 3.18.0 but skipped this module, created two months earlier, and added no `dependencyManagement` override — the shaded jar still bundles 3.17.0, and NOTICE line 23 still states 3.12.0. For snappy-java, NOTICE line 34 already declares 1.1.10.8, yet 1.1.10.4 is bundled. `paimon-azure-impl` and `paimon-s3-impl` re-bundle this module with `*:*`, so the vulnerable classes reach published artifacts. **Anything else?** Fix: mirror the merged sibling fix #8560 — pin `commons-lang3:3.18.0` and `snappy-java:${snappy.version}` in `dependencyManagement`, and correct NOTICE line 23. **Are you willing to submit a PR?** - [x] I'm willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
