dongjoon-hyun opened a new pull request, #58920: URL: https://github.com/apache/spark/pull/58920
### What changes were proposed in this pull request? This PR upgrades Apache ZooKeeper to 3.9.6 for Apache Spark 5.0.0. ### Why are the changes needed? ZooKeeper 3.9.6 is the latest release with bug fixes and security fixes. - https://zookeeper.apache.org/doc/r3.9.6/releasenotes.html (2026-09-15) It resolves the following CVEs which affect ZooKeeper 3.9.0 through 3.9.5. - https://www.cve.org/CVERecord?id=CVE-2026-59739 (Critical): Information disclosure via SetWatches reconnect replay - https://www.cve.org/CVERecord?id=CVE-2026-79993 (Critical): Missing ACL check on deleteContainer opcode - https://www.cve.org/CVERecord?id=CVE-2026-59969 (Important): Improper validation of certificate with host mismatch in FIPS mode - https://www.cve.org/CVERecord?id=CVE-2026-84439 (Important): Audit log injection via unsanitized output - https://www.cve.org/CVERecord?id=CVE-2026-84501 (Moderate): Operational log forgery via newline injection ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Opus 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
