You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pinot.apache.org by xi...@apache.org on 2026/10/16 20:52:37 UTC
(pinot) 13/14: Strip hadoop-client-runtime's relocated jline 3.9.0 from shaded plugin jars (#926)
This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a commit to branch release-1.6.0-rc
in repository https://gitbox.apache.org/repos/asf/pinot.git
commit 3e6c0187b130e48efe45600f3a9037df49c65e1d
Author: Dylan Dreyer <dy...@startree.ai>
AuthorDate: Tue Oct 13 14:30:57 2026 -0700
Strip hadoop-client-runtime's relocated jline 3.9.0 from shaded plugin jars (#926)
hadoop-client-runtime (every release through 3.5.0) bundles a relocated jline 3.9.0 under
org.apache.hadoop.shaded.org.jline for Hadoop's interactive CLIs. Nothing else in the uber-jar
references it, but its jline-* Maven metadata makes scanners flag jline-builtins and
jline-remote-telnet 3.9.0 CVEs in pinot-parquet. Strip it with the existing hadoop-client-runtime
shade filter, the same way the relocated Jetty is removed.
Co-authored-by: Claude Opus 5.5 <no...@anthropic.com>
---
pom.xml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/pom.xml b/pom.xml
index 40b21aeeeaa..6caa4563ae2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2976,6 +2976,12 @@
<exclude>META-INF/maven/org.eclipse.jetty.websocket/**</exclude>
<!-- ServiceLoader entries whose implementation classes are removed above. -->
<exclude>META-INF/services/org.apache.hadoop.shaded.org.eclipse.jetty.**</exclude>
+ <!-- The uber-jar also bundles a relocated jline 3.9.0 (org.apache.hadoop.shaded.org.jline), used
+ only by Hadoop's interactive CLIs; nothing else in the uber-jar references it. Its jline-*
+ Maven metadata makes scanners flag jline-builtins / jline-remote-telnet 3.9.0 CVEs. -->
+ <exclude>org/apache/hadoop/shaded/org/jline/**</exclude>
+ <exclude>META-INF/maven/org.jline/**</exclude>
+ <exclude>META-INF/services/org.apache.hadoop.shaded.org.jline.**</exclude>
</excludes>
</filter>
</filters>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org