This is an automated email from the ASF dual-hosted git repository. MartijnVisser pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/flink.git
commit 458ed943a95be08004707e60c3603e37a2b44f95 Author: Martijn Visser <[email protected]> AuthorDate: Sun Oct 18 19:30:27 2026 +0200 [FLINK-41021][fs] Update commons-beanutils to 1.11.0 1.9.4 is affected by CVE-2025-48734. flink-s3-fs-hadoop and flink-s3-fs-presto pin their own version, so they stay on 1.9.4 unless flink-fs-hadoop-shaded and both S3 modules are bumped. flink-yarn keeps its 1.8.3 test pin for the Hadoop 2 build. Generated-by: Claude Code (Claude Opus 5.5) --- flink-filesystems/flink-fs-hadoop-shaded/pom.xml | 2 +- .../flink-fs-hadoop-shaded/src/main/resources/META-INF/NOTICE | 2 +- flink-filesystems/flink-s3-fs-hadoop/pom.xml | 2 +- flink-filesystems/flink-s3-fs-hadoop/src/main/resources/META-INF/NOTICE | 2 +- flink-filesystems/flink-s3-fs-presto/pom.xml | 2 +- flink-filesystems/flink-s3-fs-presto/src/main/resources/META-INF/NOTICE | 2 +- flink-table/flink-sql-client/pom.xml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/flink-filesystems/flink-fs-hadoop-shaded/pom.xml b/flink-filesystems/flink-fs-hadoop-shaded/pom.xml index 8352d69b03f..10fd70ba78d 100644 --- a/flink-filesystems/flink-fs-hadoop-shaded/pom.xml +++ b/flink-filesystems/flink-fs-hadoop-shaded/pom.xml @@ -41,7 +41,7 @@ under the License. <!-- Bumped for security purposes --> <groupId>commons-beanutils</groupId> <artifactId>commons-beanutils</artifactId> - <version>1.9.4</version> + <version>1.11.0</version> </dependency> </dependencies> </dependencyManagement> diff --git a/flink-filesystems/flink-fs-hadoop-shaded/src/main/resources/META-INF/NOTICE b/flink-filesystems/flink-fs-hadoop-shaded/src/main/resources/META-INF/NOTICE index ad0f66bc5bb..ee56a96ae1c 100644 --- a/flink-filesystems/flink-fs-hadoop-shaded/src/main/resources/META-INF/NOTICE +++ b/flink-filesystems/flink-fs-hadoop-shaded/src/main/resources/META-INF/NOTICE @@ -14,7 +14,7 @@ This project bundles the following dependencies under the Apache Software Licens - com.google.guava:guava:27.0-jre - com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava - com.google.j2objc:j2objc-annotations:1.1 -- commons-beanutils:commons-beanutils:1.9.4 +- commons-beanutils:commons-beanutils:1.11.0 - commons-collections:commons-collections:3.2.2 - commons-io:commons-io:2.15.1 - commons-logging:commons-logging:1.1.3 diff --git a/flink-filesystems/flink-s3-fs-hadoop/pom.xml b/flink-filesystems/flink-s3-fs-hadoop/pom.xml index 098296e4956..19e10fe7bc7 100644 --- a/flink-filesystems/flink-s3-fs-hadoop/pom.xml +++ b/flink-filesystems/flink-s3-fs-hadoop/pom.xml @@ -62,7 +62,7 @@ under the License. <!-- Bumped for security purposes --> <groupId>commons-beanutils</groupId> <artifactId>commons-beanutils</artifactId> - <version>1.9.4</version> + <version>1.11.0</version> </dependency> </dependencies> </dependencyManagement> diff --git a/flink-filesystems/flink-s3-fs-hadoop/src/main/resources/META-INF/NOTICE b/flink-filesystems/flink-s3-fs-hadoop/src/main/resources/META-INF/NOTICE index 89e5c0c3fb1..26da9ff58c1 100644 --- a/flink-filesystems/flink-s3-fs-hadoop/src/main/resources/META-INF/NOTICE +++ b/flink-filesystems/flink-s3-fs-hadoop/src/main/resources/META-INF/NOTICE @@ -18,7 +18,7 @@ This project bundles the following dependencies under the Apache Software Licens - com.google.guava:guava:27.0-jre - com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava - com.google.j2objc:j2objc-annotations:1.1 -- commons-beanutils:commons-beanutils:1.9.4 +- commons-beanutils:commons-beanutils:1.11.0 - commons-codec:commons-codec:1.15 - commons-collections:commons-collections:3.2.2 - commons-io:commons-io:2.15.1 diff --git a/flink-filesystems/flink-s3-fs-presto/pom.xml b/flink-filesystems/flink-s3-fs-presto/pom.xml index cb3236ce1a6..d2a783f256f 100644 --- a/flink-filesystems/flink-s3-fs-presto/pom.xml +++ b/flink-filesystems/flink-s3-fs-presto/pom.xml @@ -528,7 +528,7 @@ under the License. <!-- Bumped for security purposes --> <groupId>commons-beanutils</groupId> <artifactId>commons-beanutils</artifactId> - <version>1.9.4</version> + <version>1.11.0</version> <optional>${flink.markBundledAsOptional}</optional> </dependency> </dependencies> diff --git a/flink-filesystems/flink-s3-fs-presto/src/main/resources/META-INF/NOTICE b/flink-filesystems/flink-s3-fs-presto/src/main/resources/META-INF/NOTICE index cfab924598a..989233d82c2 100644 --- a/flink-filesystems/flink-s3-fs-presto/src/main/resources/META-INF/NOTICE +++ b/flink-filesystems/flink-s3-fs-presto/src/main/resources/META-INF/NOTICE @@ -31,7 +31,7 @@ This project bundles the following dependencies under the Apache Software Licens - com.google.guava:failureaccess:1.0.1 - com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava - com.google.inject:guice:5.1.0 -- commons-beanutils:commons-beanutils:1.9.4 +- commons-beanutils:commons-beanutils:1.11.0 - commons-codec:commons-codec:1.15 - commons-collections:commons-collections:3.2.2 - commons-io:commons-io:2.15.1 diff --git a/flink-table/flink-sql-client/pom.xml b/flink-table/flink-sql-client/pom.xml index 4a48e61371a..6c61a867d76 100644 --- a/flink-table/flink-sql-client/pom.xml +++ b/flink-table/flink-sql-client/pom.xml @@ -222,7 +222,7 @@ under the License. <!-- dependency convergence --> <groupId>commons-beanutils</groupId> <artifactId>commons-beanutils</artifactId> - <version>1.9.4</version> + <version>1.11.0</version> <scope>test</scope> </dependency> <dependency>
