CalvinKirs opened a new pull request, #68445:
URL: https://github.com/apache/doris/pull/68445
### What problem does this PR solve?
Issue Number: None
Problem Summary: OWASP dependency-check flagged several FE third-party
dependencies with known CVEs that have fixed releases available. Bump
each to its fixed version:
- ranger-plugins-common 2.8.0 -> 2.9.0 (several CRITICAL RCE/injection CVEs)
- netty 4.2.15.Final -> 4.2.17.Final
- httpclient5 5.6.3 -> 5.6.4
- hbase 2.6.3 -> 2.6.6
- jline 3.30.6 -> 3.30.14
- parquet 1.17.0 -> 1.18.0
- log4j2 2.25.4 -> 2.25.5
Also exclude io.airlift:http-server from trino-main: it pulls in Jetty
11 server-side jars (jetty-servlet, http2-server) that Doris never
uses, mirroring the exclusion already applied on the BE side in
be-java-extensions/trino-connector-scanner.
### Release note
None
### Check List (For Author)
- Test: Manual test
- `mvn dependency:tree` on the affected reactor resolves cleanly with no
version conflicts.
- `fe-authorization-plugin-ranger-doris`/`-hive` compile after the
Ranger bump.
- `fe-connector-trino` compiles and its full unit test suite passes
(62/62) after the trino-main exclusion.
- Behavior changed: No
- Does this need documentation: No
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
