You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by sl...@apache.org on 2025/09/24 08:55:00 UTC
(hadoop) branch branch-3.4 updated: HADOOP-19632. Upgrade nimbus-jose-jwt to 10.4 due to CVE-2025-53864 (#7993) Contributed by Rohit Kumar.
This is an automated email from the ASF dual-hosted git repository.
slfan1989 pushed a commit to branch branch-3.4
in repository https://gitbox.apache.org/repos/asf/hadoop.git
The following commit(s) were added to refs/heads/branch-3.4 by this push:
new 6ff17315afa HADOOP-19632. Upgrade nimbus-jose-jwt to 10.4 due to CVE-2025-53864 (#7993) Contributed by Rohit Kumar.
6ff17315afa is described below
commit 6ff17315afa867b2510a862bbe08be5ece0474cd
Author: rohit-kb <11...@users.noreply.github.com>
AuthorDate: Wed Sep 24 14:24:52 2025 +0530
HADOOP-19632. Upgrade nimbus-jose-jwt to 10.4 due to CVE-2025-53864 (#7993) Contributed by Rohit Kumar.
* HADOOP-19632. Upgrade nimbus-jose-jwt to 10.4 due to CVE-2025-53864
Signed-off-by: Shilun Fan <sl...@apache.org>
---
LICENSE-binary | 2 +-
hadoop-project/pom.xml | 8 +++++++-
hadoop-tools/hadoop-sls/pom.xml | 5 +++++
.../hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml | 5 +++++
.../hadoop-yarn-server/hadoop-yarn-server-router/pom.xml | 5 +++++
5 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/LICENSE-binary b/LICENSE-binary
index 30235646adb..d2718e564c7 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -240,7 +240,7 @@ com.google.guava:guava:20.0
com.google.guava:guava:32.0.1-jre
com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
com.microsoft.azure:azure-storage:7.0.0
-com.nimbusds:nimbus-jose-jwt:9.37.2
+com.nimbusds:nimbus-jose-jwt:10.4
com.zaxxer:HikariCP:4.0.3
commons-beanutils:commons-beanutils:1.9.4
commons-cli:commons-cli:1.9.0
diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
index 380684cf53b..81779ada66d 100644
--- a/hadoop-project/pom.xml
+++ b/hadoop-project/pom.xml
@@ -233,7 +233,8 @@
<openssl-wildfly.version>2.1.4.Final</openssl-wildfly.version>
<jsonschema2pojo.version>1.0.2</jsonschema2pojo.version>
<woodstox.version>5.4.0</woodstox.version>
- <nimbus-jose-jwt.version>9.37.2</nimbus-jose-jwt.version>
+ <nimbus-jose-jwt.version>10.4</nimbus-jose-jwt.version>
+ <jcip-annotations.version>1.0-1</jcip-annotations.version>
<nodejs.version>v12.22.1</nodejs.version>
<yarnpkg.version>v1.22.5</yarnpkg.version>
<apache-ant.version>1.10.13</apache-ant.version>
@@ -1602,6 +1603,11 @@
<artifactId>jaxb-api</artifactId>
<version>2.2.11</version>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <version>${jcip-annotations.version}</version>
+ </dependency>
<dependency>
<groupId>org.codehaus.jettison</groupId>
<artifactId>jettison</artifactId>
diff --git a/hadoop-tools/hadoop-sls/pom.xml b/hadoop-tools/hadoop-sls/pom.xml
index a032f20bc33..771ba87e0bb 100644
--- a/hadoop-tools/hadoop-sls/pom.xml
+++ b/hadoop-tools/hadoop-sls/pom.xml
@@ -78,6 +78,11 @@
<artifactId>mockito-core</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
index 14ea21d895d..9aad28778b7 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml
@@ -335,6 +335,11 @@
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
index 2483963ab0f..a5665c6740e 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-router/pom.xml
@@ -168,6 +168,11 @@
<type>test-jar</type>
</dependency>
+ <dependency>
+ <groupId>com.github.stephenc.jcip</groupId>
+ <artifactId>jcip-annotations</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<build>
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org