You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@asterixdb.apache.org by im...@apache.org on 2026/08/06 18:19:42 UTC
(asterixdb) 04/14: [NO ISSUE][MISC] Update Dependencies to address CVEs
This is an automated email from the ASF dual-hosted git repository.
parshimers pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/asterixdb.git
commit 814d5cfb7a4ba35513cd757ea06e9b20e0128f37
Author: Michael Blow <mi...@couchbase.com>
AuthorDate: Tue Aug 4 18:45:37 2026 -0400
[NO ISSUE][MISC] Update Dependencies to address CVEs
- com.azure (azureblobjavasdk.version) 12.31.1 → 12.31.3
- com.azure (azurecommonjavasdk.version) 12.30.1 → 12.30.3
- com.azure (azurecorehttpnetty.version) 1.16.3 → 1.16.5
- com.azure (azuredatalakejavasdk.version) 12.24.1 → 12.24.3
- com.sun.xml.bind:jaxb-impl: 2.3.2 → 2.3.9
- commons-codec:commons-codec: 1.22.0 → 1.22.1
- it.unimi.dsi:fastutil: 8.5.6 → 8.5.19
- javax.xml.bind:jaxb-api: 2.3.0 → 2.3.1
- org.apache.maven
- maven-artifact: 3.8.4 → 3.8.9
- maven-compat: 3.8.4 → 3.8.9
- maven-core: 3.8.4 → 3.8.9
- maven-model: 3.8.4 → 3.8.9
- maven-plugin-api: 3.8.4 → 3.8.9
- org.apache.maven.plugins
- maven-assembly-plugin: 3.1.0 → 3.1.1
- maven-compiler-plugin: 3.8.0 → 3.8.1
- maven-dependency-plugin: 3.6.0 → 3.6.1
- org.freemarker:freemarker: 2.3.31 → 2.3.34
- org.glassfish.jaxb:jaxb-runtime: 2.3.5 → 2.3.9
Record existing constraints as version comments so the dependency
updater skips them rather than offering known-bad updates. These already
exist on master and are ported so both branches carry the same
knowledge: twitter4j cannot build past 4.0.3; the core-io 1.x here must
not move until its uses are removed; apache-rat 0.15+ removed the
license implementation classes these poms configure; akka-http-core must
stay on 10.1.x to match s3mock; maven-antrun-plugin must not reach
3.2.0.
Ext-ref: MB-73147
Co-Authored-By: Claude Opus 5 <no...@anthropic.com>
Change-Id: Ib08202babcaf95c6b174777a40180e62b700d9b4
Reviewed-on: https://asterix-gerrit.ics.uci.edu/c/asterixdb/+/21491
Reviewed-by: Michael Blow <mb...@apache.org>
Integration-Tests: Jenkins <je...@fulliautomatix.ics.uci.edu>
Tested-by: Jenkins <je...@fulliautomatix.ics.uci.edu>
Reviewed-by: Ian Maxon <im...@apache.org>
---
asterixdb/asterix-external-data/pom.xml | 5 ++--
asterixdb/pom.xml | 35 ++++++++++++----------
.../license-automation-plugin/pom.xml | 2 +-
hyracks-fullstack/pom.xml | 21 ++++++-------
4 files changed, 35 insertions(+), 28 deletions(-)
diff --git a/asterixdb/asterix-external-data/pom.xml b/asterixdb/asterix-external-data/pom.xml
index b79384e763..cb0e001c49 100644
--- a/asterixdb/asterix-external-data/pom.xml
+++ b/asterixdb/asterix-external-data/pom.xml
@@ -261,13 +261,13 @@
<dependency>
<groupId>org.twitter4j</groupId>
<artifactId>twitter4j-core</artifactId>
- <version>4.0.3</version>
+ <version>4.0.3</version> <!-- do not update unless necessary, we cannot build against newer versions-->
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.twitter4j</groupId>
<artifactId>twitter4j-stream</artifactId>
- <version>4.0.3</version>
+ <version>4.0.3</version> <!-- do not update unless necessary, we cannot build against newer versions-->
<scope>provided</scope>
</dependency>
<dependency>
@@ -283,6 +283,7 @@
<artifactId>privilegedaccessor</artifactId>
<scope>test</scope>
</dependency>
+ <!-- TODO: remove this core-io and its uses- DO NOT UPDATE this until that time -->
<dependency>
<groupId>com.couchbase.client</groupId>
<artifactId>core-io</artifactId>
diff --git a/asterixdb/pom.xml b/asterixdb/pom.xml
index dbdf6e3388..38ff086e26 100644
--- a/asterixdb/pom.xml
+++ b/asterixdb/pom.xml
@@ -92,12 +92,12 @@
<parquet.version>1.17.1</parquet.version> <!-- NOTICE: please update transitives from parquet below on any change -->
<hadoop-awsjavasdk.version>1.12.797</hadoop-awsjavasdk.version>
- <azureblobjavasdk.version>12.31.1</azureblobjavasdk.version>
- <azurecommonjavasdk.version>12.30.1</azurecommonjavasdk.version>
+ <azureblobjavasdk.version>12.31.3</azureblobjavasdk.version>
+ <azurecommonjavasdk.version>12.30.3</azurecommonjavasdk.version>
<azureidentity.version>1.17.0</azureidentity.version>
- <azuredatalakejavasdk.version>12.24.1</azuredatalakejavasdk.version>
+ <azuredatalakejavasdk.version>12.24.3</azuredatalakejavasdk.version>
<azurecore.version>1.57.1</azurecore.version>
- <azurecorehttpnetty.version>1.16.3</azurecorehttpnetty.version>
+ <azurecorehttpnetty.version>1.16.5</azurecorehttpnetty.version>
<gcsjavasdk.version>2.64.1</gcsjavasdk.version>
<hadoop-azuresdk.version>8.6.6</hadoop-azuresdk.version>
@@ -359,7 +359,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
- <version>3.8.0</version>
+ <version>3.8.1</version>
</plugin>
<!--This plugin's configuration is used to store Eclipse m2e settings only. It has no influence on the Maven build itself.-->
<plugin>
@@ -495,6 +495,7 @@
<plugin>
<groupId>org.apache.rat</groupId>
<artifactId>apache-rat-plugin</artifactId>
+ <!-- @pinned: 0.15+ removed the license/licenseFamily implementation classes configured above -->
<version>0.12</version>
</plugin>
<plugin>
@@ -505,11 +506,12 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-assembly-plugin</artifactId>
- <version>3.1.0</version>
+ <version>3.1.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-antrun-plugin</artifactId>
+ <!-- do not update to 3.2.0, it adds lots of warning spam (https://github.com/apache/maven-antrun-plugin/issues/348) -->
<version>3.0.0</version>
</plugin>
<plugin>
@@ -535,7 +537,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
- <version>3.6.0</version>
+ <version>3.6.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
@@ -560,7 +562,7 @@
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
- <version>2.3.5</version>
+ <version>2.3.9</version>
</dependency>
</dependencies>
</plugin>
@@ -969,12 +971,12 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-plugin-api</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-model</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
@@ -1472,12 +1474,12 @@
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
- <version>1.22.0</version>
+ <version>1.22.1</version>
</dependency>
<dependency>
<groupId>it.unimi.dsi</groupId>
<artifactId>fastutil</artifactId>
- <version>8.5.6</version>
+ <version>8.5.19</version>
</dependency>
<dependency>
<groupId>com.sun.xml.bind</groupId>
@@ -1487,7 +1489,7 @@
<dependency>
<groupId>com.sun.xml.bind</groupId>
<artifactId>jaxb-impl</artifactId>
- <version>2.3.2</version>
+ <version>2.3.9</version>
</dependency>
<dependency>
<groupId>javax.activation</groupId>
@@ -1502,12 +1504,12 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-compat</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>com.esri.geometry</groupId>
@@ -1582,6 +1584,9 @@
<dependency>
<groupId>com.typesafe.akka</groupId>
<artifactId>akka-http-core_2.12</artifactId>
+ <!-- @pinned: do not advance past 10.1.x. s3mock 0.2.5 pulls akka-http_2.12 on the 10.1
+ line and the two must match (10.5.x makes S3Mock.bind() return null); 10.2+ is also
+ BUSL-1.1 rather than Apache-2.0. -->
<version>10.1.0</version>
</dependency>
<!-- Azure Blob Storage start -->
diff --git a/hyracks-fullstack/hyracks/hyracks-maven-plugins/license-automation-plugin/pom.xml b/hyracks-fullstack/hyracks/hyracks-maven-plugins/license-automation-plugin/pom.xml
index b333838286..23b8fa461d 100644
--- a/hyracks-fullstack/hyracks/hyracks-maven-plugins/license-automation-plugin/pom.xml
+++ b/hyracks-fullstack/hyracks/hyracks-maven-plugins/license-automation-plugin/pom.xml
@@ -53,7 +53,7 @@
<dependency>
<groupId>org.freemarker</groupId>
<artifactId>freemarker</artifactId>
- <version>2.3.31</version>
+ <version>2.3.34</version>
</dependency>
<dependency>
<groupId>commons-io</groupId>
diff --git a/hyracks-fullstack/pom.xml b/hyracks-fullstack/pom.xml
index dcc4043395..9835b29553 100644
--- a/hyracks-fullstack/pom.xml
+++ b/hyracks-fullstack/pom.xml
@@ -412,6 +412,7 @@
<dependency>
<groupId>org.apache.rat</groupId>
<artifactId>apache-rat-plugin</artifactId>
+ <!-- @pinned: 0.15+ removed the license/licenseFamily implementation classes configured below -->
<version>0.13</version>
</dependency>
<dependency>
@@ -442,7 +443,7 @@
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
- <version>2.3.0</version>
+ <version>2.3.1</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
@@ -452,27 +453,27 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-model</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-artifact</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-compat</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-plugin-api</artifactId>
- <version>3.8.4</version>
+ <version>3.8.9</version>
</dependency>
<dependency>
<groupId>org.apache.maven.plugin-tools</groupId>
@@ -487,7 +488,7 @@
<dependency>
<groupId>it.unimi.dsi</groupId>
<artifactId>fastutil</artifactId>
- <version>8.5.6</version>
+ <version>8.5.19</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
@@ -786,7 +787,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
- <version>3.8.0</version>
+ <version>3.8.1</version>
</plugin>
<plugin>
<groupId>org.apache.rat</groupId>
@@ -931,7 +932,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-assembly-plugin</artifactId>
- <version>3.1.0</version>
+ <version>3.1.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
@@ -956,7 +957,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
- <version>3.6.0</version>
+ <version>3.6.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.doxia</groupId>