thswlsqls opened a new pull request, #8935: URL: https://github.com/apache/paimon/pull/8935
### Purpose fix #8933 - `hadoop-common:3.4.2` pulls `commons-lang3:3.17.0` (CVE-2025-48924) and `snappy-java:1.1.10.4` into the shaded jar, unrelocated. - #6781 raised seven filesystem NOTICE files to 3.18.0 but skipped this module (created two months earlier) and added no pom override. NOTICE already declares `snappy-java:1.1.10.8` while 1.1.10.4 ships. - Pin both in `dependencyManagement`, mirroring the merged sibling fix #8560. - NOTICE line 23 is corrected too; #8560 needed no NOTICE change because the sibling entry was already right. - `paimon-azure-impl` and `paimon-s3-impl` re-bundle this module with `<include>*:*</include>`, so the classes reach published artifacts. ### Tests - No test added — the module has no Java sources and this is not a runtime change. - `mvn -pl paimon-filesystems/paimon-hadoop-shaded-3.4 -DfailIfNoTests=false clean install` — BUILD SUCCESS (JDK 11). - `dependency:tree` before `3.17.0` / `1.1.10.4`, after `3.18.0` / `1.1.10.8`; shade log confirms both in the jar. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
