(paimon) branch master updated: [fs] Force CVE-patched commons-lang3 and snappy-java in hadoop-shaded (#8560)

[lz...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

JingsongLi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/paimon.git


The following commit(s) were added to refs/heads/master by this push:
     new 73d38b6df3 [fs] Force CVE-patched commons-lang3 and snappy-java in hadoop-shaded (#8560)
73d38b6df3 is described below

commit 73d38b6df3c3ec26680af82e68e3c9ce9e649a25
Author: Eunbin Son <58...@users.noreply.github.com>
AuthorDate: Mon Jul 13 11:21:21 2026 +0900

    [fs] Force CVE-patched commons-lang3 and snappy-java in hadoop-shaded (#8560)
---
 paimon-filesystems/paimon-hadoop-shaded/pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/paimon-filesystems/paimon-hadoop-shaded/pom.xml b/paimon-filesystems/paimon-hadoop-shaded/pom.xml
index 585511378d..cdd2363b6c 100644
--- a/paimon-filesystems/paimon-hadoop-shaded/pom.xml
+++ b/paimon-filesystems/paimon-hadoop-shaded/pom.xml
@@ -44,6 +44,18 @@
                 <artifactId>commons-beanutils</artifactId>
                 <version>${commons.beanutils.version}</version>
             </dependency>
+            <dependency>
+                <!-- Bumped for security purposes (CVE-2025-48924); aligns bundled version with NOTICE -->
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>3.18.0</version>
+            </dependency>
+            <dependency>
+                <!-- Bumped for security purposes; aligns bundled version with NOTICE -->
+                <groupId>org.xerial.snappy</groupId>
+                <artifactId>snappy-java</artifactId>
+                <version>${snappy.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>