You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@flink.apache.org by "Martijn Visser (Jira)" <ji...@apache.org> on 2026/10/18 17:15:00 UTC

[jira] [Created] (FLINK-41021) Update commons-beanutils to 1.11.0 and jsoup to 1.23.2

Martijn Visser created FLINK-41021:
--------------------------------------

             Summary: Update commons-beanutils to 1.11.0 and jsoup to 1.23.2
                 Key: FLINK-41021
                 URL: https://issues.apache.org/jira/browse/FLINK-41021
             Project: Flink
          Issue Type: Technical Debt
          Components: Build System, FileSystems
            Reporter: Martijn Visser
            Assignee: Martijn Visser
             Fix For: 2.4.0


commons-beanutils 1.9.4, which flink-s3-fs-hadoop and flink-s3-fs-presto bundle, is affected by CVE-2025-48734, and the jsoup version used by flink-docs tests has open advisories too.

We should update commons-beanutils to 1.11.0 in all three modules that pin it (flink-fs-hadoop-shaded and both S3 file systems) and in their NOTICE files, and jsoup to 1.23.2. The open Dependabot PR only bumps flink-fs-hadoop-shaded, which leaves the S3 jars on 1.9.4.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)