kakavenkat opened a new pull request, #18753: URL: https://github.com/apache/iceberg/pull/18753
Backports #17888 and #18453 to `1.11.x`. `iceberg-bundled-guava` 1.11.0 bundles Guava 33.6.0-jre, which is affected by [CVE-2026-102554](https://nvd.nist.gov/vuln/detail/CVE-2026-102554) (CVSS 4.0: 8.2). When Guava deserializes `CompactHashMap`, `CompactHashSet` or `MapMakerInternalMap`, it allocates an array sized by the serialized stream with no limit, so a crafted stream can cause an `OutOfMemoryError`. Guava 4.0 through 33.7.1 are affected, and the fix is in 33.7.2. `main` already has 33.7.2. 1.12.0 ships 33.7.1, so it is still affected. Users on the 1.11 line currently have no fixed release to move to, and security scanners flag the bundled jar. Changes: - **#17888:** replace relocated Guava `Queues` with plain JDK `ConcurrentLinkedQueue` / `ArrayDeque`. With Guava 33.7.x, the `minimize()` step in `shadowJar` no longer keeps `Queues` in the bundled jar, so core, Flink and Spark fail to compile without this change. It applies to the module versions on this branch: Flink 1.20/2.0/2.1 and Spark 3.4/3.5/4.0/4.1. - **#18453:** bump `guava` to 33.7.2-jre (33.6.0 → 33.7.2, minor update within 33.x). **Testing:** - `./gradlew -DallModules spotlessCheck compileJava compileTestJava` passes (all Flink and Spark versions on this branch) - `./gradlew :iceberg-bundled-guava:build :iceberg-api:check :iceberg-core:check` passes (JDK 21) If the maintainers agree, it would be great to include this in a 1.11.1 release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
