Devdha opened a new pull request, #3880: URL: https://github.com/apache/parquet-java/pull/3880
## Background CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, fixed in Brotli 1.2.1. Parquet's `BROTLI` codec currently comes from the abandoned `com.github.rdblue:brotli-codec:0.1.1` artifact (last release 2021), which wraps `org.meteogroup.jbrotli:jbrotli:0.5.0`. That native library bundles Brotli **0.5.0**, so reading an untrusted Brotli-compressed Parquet file can reach a very old decoder. The replacement uses the maintained `com.aayushatharva.brotli4j:brotli4j:1.24.0`, which bundles Brotli **1.2.1**: - https://github.com/hyperxpro/Brotli4j/releases/tag/v1.24.0 - https://github.com/hyperxpro/Brotli4j/security/advisories/GHSA-x524-jrqf-vwq6 - https://patchtheplanet.com/brotli / https://patchtheplanet.org/brotli ## Change - Add a Parquet-owned `org.apache.parquet.hadoop.codec.BrotliCodec` with streaming `CompressionInputStream`/`CompressionOutputStream` adapters backed by brotli4j. - Point `CompressionCodecName.BROTLI` at the new codec. - Replace the `brotli-codec` dependency with optional `brotli4j`; remove the JitPack repository and the `non-aarch64` profile. brotli4j ships ARM64 natives, so the PARQUET-1975 ARM64 skip can go away. - Teach `DirectCodecFactory` to fall back to the stream-based decompressor for codecs that do not expose a Hadoop `Decompressor` (Brotli is one). - Add `TestBrotliCodec` and enable Brotli in `TestDirectCodecFactory` on ARM64. Compatibility: the on-disk format and `.br` extension are unchanged. Code that referenced the old `org.apache.hadoop.io.compress.BrotliCodec` class directly should use `CompressionCodecName.BROTLI`/`CodecFactory` or the new class. Users still need to add the optional `brotli4j` dependency (as they previously needed `brotli-codec`). ## Testing ``` ./mvnw -pl parquet-hadoop -am \ -Dtest="TestBrotliCodec,TestDirectCodecFactory#compressionCodecs" \ -Dsurefire.failIfNoSpecifiedTests=false -DskipITs test ``` - `TestBrotliCodec`: 1 passed - `TestDirectCodecFactory.compressionCodecs`: 1 passed (Brotli now exercised on aarch64) Also ran `mvn -pl parquet-hadoop -am -DskipTests package` successfully, including the bundle/OSGi packaging step. The local run used `-Denforcer.skip=true` only because current master has an unrelated JUnit 4 import in `TestFooterIntegrity` (being migrated in #3878). I could not find an existing PARQUET JIRA for this; happy to file one if required before review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
