You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "KVRahul16 (via GitHub)" <gi...@apache.org> on 2026/10/30 17:44:59 UTC
[PR] chore(deps): pin commons-compress, commons-configuration2, and snappy-java to versions above CVE fix boundaries [polaris]
KVRahul16 opened a new pull request, #5940:
URL: https://github.com/apache/polaris/pull/5940
## Why
Hadoop 3.5.0 transitively pins three libraries at versions below known CVE fix
boundaries. Because Polaris declares `hadoop-common`, `hadoop-client-api`, and
`hadoop-client-runtime` as direct dependencies, these older versions land on the
runtime classpath of the Hadoop and Hive federation modules. None of these
libraries are Quarkus platform-managed, so overriding them carries no BOM
coordination risk.
## What changed
Added a `configurations.configureEach { resolutionStrategy.eachDependency { … } }`
block in `polaris-base.gradle.kts`:
| Library | Hadoop 3.5.0 pin | Overridden to | Fix boundary |
|---|---|---|---|
| `org.apache.commons:commons-compress` | 1.26.1 | **1.28.0** | 1.27.0 — CVE-2024-25710, CVE-2024-26308 |
| `org.apache.commons:commons-configuration2` | 2.10.1 | **2.15.1** | 2.15.0 — CVE-2026-45205 |
| `org.xerial.snappy:snappy-java` | 1.1.10.4 | **1.1.10.12** | Quarkus BOM version |
Each rule uses `.because()` to document the upstream pin and fix boundary.
## Testing
- `./gradlew spotlessKotlinGradleCheck :polaris-extensions-federation-hadoop:check :polaris-extensions-federation-hive:check :polaris-build-logic:check`
passes cleanly (224 tasks, no errors).
- Confirmed via `dependencyInsight` on the Hadoop federation module:
- `commons-compress:1.28.0` — Selected by rule ✅
- `commons-configuration2:2.15.1` — Selected by rule ✅
- `snappy-java:1.1.10.12` — Selected by rule ✅
- No logic changes; purely dependency version overrides.
```
./gradlew spotlessKotlinGradleCheck :polaris-extensions-federation-hadoop:check :polaris-extensions-federation-hive:check :polaris-build-logic:check 2>&1 | tail -15
> Task :polaris-extensions-federation-hive:testClasses UP-TO-DATE
> Task :polaris-extensions-federation-hadoop:checkstyleTestFixtures NO-SOURCE
> Task :polaris-extensions-federation-hive:checkstyleTest NO-SOURCE
> Task :polaris-extensions-federation-hive:checkstyleTestFixtures NO-SOURCE
> Task :polaris-extensions-federation-hadoop:jar UP-TO-DATE
> Task :polaris-extensions-federation-hive:jar UP-TO-DATE
> Task :polaris-core:jandex
> Task :polaris-core:jar UP-TO-DATE
> Task :polaris-extensions-federation-hive:test NO-SOURCE
> Task :polaris-extensions-federation-hadoop:test NO-SOURCE
> Task :polaris-extensions-federation-hive:check
> Task :polaris-extensions-federation-hadoop:check
BUILD SUCCESSFUL in 7s
224 actionable tasks: 8 executed, 108 from cache, 108 up-to-date
```
```
./gradlew :polaris-extensions-federation-hadoop:dependencyInsight --dependency $dep --configuration runtimeClasspath 2>/dev/null | grep "Selected by rule" | head -1; done
commons-compress: - Selected by rule: Maintenance update: commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the 1.27.0 fix boundary for CVE-2024-25710 and CVE-2024-26308; align with Quarkus BOM
commons-configuration2: - Selected by rule: Maintenance update: commons-configuration2 2.10.1 (pinned by Hadoop 3.5.0) is below the 2.15.0 fix boundary for CVE-2026-45205; 2.15.1 is the latest 2.15.x release
snappy-java: - Selected by rule: Maintenance update: snappy-java 1.1.10.4 (pinned by Hadoop 3.5.0) is below the Quarkus BOM version; align to 1.1.10.12
```
> This PR was prepared with significant AI assistance. The author has reviewed
> and validated all changes end-to-end and takes full responsibility for the
> contribution, per the
> [AI-assisted contribution guidelines](CONTRIBUTING.md#guidelines-for-ai-assisted-contributions).
@snazy @jbonofre @adutra
## Checklist
- [x] 🛡️ Don't disclose security issues! (contact security@apache.org)
- [x] 🔗 Clearly explained why the changes are needed
- [x] 🧪 Manually tested: module `check` tasks pass; versions confirmed via `dependencyInsight`
- [x] 💡 Added comments for complex logic — `.because()` documents the upstream pin and fix boundary inline
- [ ] 🧾 Updated `CHANGELOG.md` — not required; no user-facing behavior change
- [ ] 📚 Updated documentation in `site/content/in-dev/unreleased` — not required; no configuration or API change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): pin commons-compress, commons-configuration2, and snappy-java to versions above CVE fix boundaries [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #5940:
URL: https://github.com/apache/polaris/pull/5940#discussion_r4427300258
##########
extensions/federation/hive/build.gradle.kts:
##########
@@ -56,6 +56,21 @@ dependencies {
exclude("io.dropwizard.metrics", "metrics-core")
}
+ constraints {
+ implementation(libs.commons.compress) {
+ because(
+ "commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the 1.27.0 fix boundary" +
+ " for CVE-2024-25710 and CVE-2024-26308",
Review Comment:
The PR description claims testing via `:polaris-extensions-federation-hive:check`, but that module does not appear to have any tests 🤷
https://github.com/apache/polaris/tree/3e80dd54ad7c7ae87dc4595bce28e071609bd437/extensions/federation/hive
It would be nice to perform some more realistic validation for these changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): constrain commons-configuration2 to 2.15.1 in Hadoop and Hive federation modules [polaris]
Posted by "KVRahul16 (via GitHub) via issues" <is...@polaris.apache.org>.
KVRahul16 commented on code in PR #5940:
URL: https://github.com/apache/polaris/pull/5940#discussion_r4444779496
##########
extensions/federation/hive/build.gradle.kts:
##########
@@ -56,6 +56,21 @@ dependencies {
exclude("io.dropwizard.metrics", "metrics-core")
}
+ constraints {
+ implementation(libs.commons.compress) {
+ because(
+ "commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the 1.27.0 fix boundary" +
+ " for CVE-2024-25710 and CVE-2024-26308",
Review Comment:
Runtime validation (Docker available, JDK 21):
```
./gradlew :polaris-runtime-spark-tests:hiveFederationIntTest \
:polaris-runtime-spark-tests:catalogFederationIntTest \
:polaris-extensions-federation-hadoop:check \
:polaris-extensions-federation-hive:check
```
:polaris-runtime-service:check and :polaris-server:check both pass, and so do format and compileAll.:
```
Stdout:
> Task :polaris-runtime-service:spotlessCheck
> Task :polaris-runtime-service:check
BUILD SUCCESSFUL in 24m 1s
1101 actionable tasks: 437 executed, 58 from cache, 606 up-to-date
```
- BUILD SUCCESSFUL
- `HiveCatalogFederationIT`: 3 tests, 0 failures, 0 skipped
- `CatalogFederationIT`: 5 tests, 0 failures, 0 skipped
- These suites run against 2.15.1: the spark-tests runtime classpath resolves `commons-configuration2:2.15.1`.
Resolution (`dependencyInsight`, `commons-configuration2`):
- `:polaris-extensions-federation-hadoop` / `-hive` `runtimeClasspath`: `2.10.1 -> 2.15.1`
- `:polaris-server` `runtimeClasspath`: `2.10.1 -> 2.15.1` (via the Hadoop federation module)
- `:polaris-runtime-service` `runtimeClasspath`: not present
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): pin commons-compress, commons-configuration2, and snappy-java to versions above CVE fix boundaries [polaris]
Posted by "orca-review-bot (via GitHub)" <gi...@apache.org>.
orca-review-bot commented on code in PR #5940:
URL: https://github.com/apache/polaris/pull/5940#discussion_r4426937428
##########
build-logic/src/main/kotlin/polaris-base.gradle.kts:
##########
@@ -26,3 +26,29 @@ extensions.getByType<CopiedCodeCheckerExtension>().apply {
addDefaultContentTypes()
licenseFile.convention(layout.settingsDirectory.file("LICENSE"))
}
+
+configurations.configureEach {
+ resolutionStrategy.eachDependency {
+ if (requested.group == "org.apache.commons" && requested.name == "commons-compress") {
+ useVersion("1.28.0")
+ because(
+ "Maintenance update: commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the" +
+ " 1.27.0 fix boundary for CVE-2024-25710 and CVE-2024-26308; align with Quarkus BOM",
+ )
+ }
+ if (requested.group == "org.apache.commons" && requested.name == "commons-configuration2") {
+ useVersion("2.15.1")
+ because(
+ "Maintenance update: commons-configuration2 2.10.1 (pinned by Hadoop 3.5.0) is below" +
+ " the 2.15.0 fix boundary for CVE-2026-45205; 2.15.1 is the latest 2.15.x release",
+ )
+ }
+ if (requested.group == "org.xerial.snappy" && requested.name == "snappy-java") {
+ useVersion("1.1.10.12")
+ because(
+ "Maintenance update: snappy-java 1.1.10.4 (pinned by Hadoop 3.5.0) is below the" +
Review Comment:
The message says this aligns with the Quarkus BOM, but quarkus-bom 3.40.1.1 pins snappy-java 1.1.10.11. So this actually overrides the BOM. Can we fix the wording, or drop the snappy rule if 1.1.10.11 is fine?
<sub>🤖 AI-generated review comment — agents make mistakes, so please verify before acting on it.</sub>
##########
build-logic/src/main/kotlin/polaris-base.gradle.kts:
##########
@@ -26,3 +26,29 @@ extensions.getByType<CopiedCodeCheckerExtension>().apply {
addDefaultContentTypes()
licenseFile.convention(layout.settingsDirectory.file("LICENSE"))
}
+
+configurations.configureEach {
Review Comment:
This sits in the base plugin, so it applies to every project's configurations, not just the Hadoop/Hive federation modules that pull these in. Today that also means the server's snappy-java changes away from the Quarkus BOM version. Can we move it into the federation modules' build files?
<sub>🤖 AI-generated review comment — agents make mistakes, so please verify before acting on it.</sub>
##########
build-logic/src/main/kotlin/polaris-base.gradle.kts:
##########
@@ -26,3 +26,29 @@ extensions.getByType<CopiedCodeCheckerExtension>().apply {
addDefaultContentTypes()
licenseFile.convention(layout.settingsDirectory.file("LICENSE"))
}
+
+configurations.configureEach {
+ resolutionStrategy.eachDependency {
+ if (requested.group == "org.apache.commons" && requested.name == "commons-compress") {
+ useVersion("1.28.0")
Review Comment:
`useVersion` replaces whatever was requested, including higher versions. Fine today. But once the BOM or Hadoop moves to, say, commons-compress 1.29, this rule silently drags it back to 1.28.0, and Renovate can't see the hardcoded version. Can we use a `version { require(...) }` constraint backed by libs.versions.toml instead? Same applies to the other two rules.
<sub>🤖 AI-generated review comment — agents make mistakes, so please verify before acting on it.</sub>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): pin commons-compress, commons-configuration2, and snappy-java to versions above CVE fix boundaries [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #5940:
URL: https://github.com/apache/polaris/pull/5940#discussion_r4427204704
##########
extensions/federation/hadoop/build.gradle.kts:
##########
@@ -53,6 +53,21 @@ dependencies {
implementation(libs.hadoop.client.api)
implementation(libs.hadoop.client.runtime)
+ constraints {
+ implementation(libs.commons.compress) {
+ because(
+ "commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the 1.27.0 fix boundary" +
+ " for CVE-2024-25710 and CVE-2024-26308",
Review Comment:
@snazy : WDYT?
##########
extensions/federation/hive/build.gradle.kts:
##########
@@ -56,6 +56,21 @@ dependencies {
exclude("io.dropwizard.metrics", "metrics-core")
}
+ constraints {
+ implementation(libs.commons.compress) {
+ because(
+ "commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the 1.27.0 fix boundary" +
+ " for CVE-2024-25710 and CVE-2024-26308",
Review Comment:
The PR description claim testing via `:polaris-extensions-federation-hive:check`, but that module does not appear to have any tests 🤷
https://github.com/apache/polaris/tree/3e80dd54ad7c7ae87dc4595bce28e071609bd437/extensions/federation/hive
It would be nice to perform some more realistic validation for these changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): pin commons-compress, commons-configuration2, and snappy-java to versions above CVE fix boundaries [polaris]
Posted by "snazy (via GitHub) via issues" <is...@polaris.apache.org>.
snazy commented on PR #5940:
URL: https://github.com/apache/polaris/pull/5940#issuecomment-6533967694
Thanks for narrowing these changes to the federation modules. The security rationale still needs correction:
- Both cited Commons Compress CVEs were fixed in **1.26.0**, so the existing **1.26.1** already includes those fixes. See the [upstream security report](https://commons.apache.org/proper/commons-compress/security.html).
- The [Commons Configuration advisory](https://commons.apache.org/proper/commons-configuration/security.html) concerns processing untrusted YAML containing cycles. The description does not establish that Polaris uses this functionality with untrusted input.
Could you explain the concrete benefit of adding these constraints?
Please assess applicability against [Polaris’s threat model](https://github.com/apache/polaris/blob/main/SECURITY-THREAT-MODEL.md); any suspected previously undisclosed Polaris vulnerability should be reported privately.
Without an applicable issue or another justified maintenance need, I would prefer to avoid taking on explicit management of these transitive dependencies.
If a change remains necessary, please also address the runtime-validation gap already raised in review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): constrain commons-configuration2 to 2.15.1 in Hadoop and Hive federation modules [polaris]
Posted by "dimas-b (via GitHub) via issues" <is...@polaris.apache.org>.
dimas-b commented on code in PR #5940:
URL: https://github.com/apache/polaris/pull/5940#discussion_r4444488582
##########
extensions/federation/hive/build.gradle.kts:
##########
@@ -56,6 +56,21 @@ dependencies {
exclude("io.dropwizard.metrics", "metrics-core")
}
+ constraints {
+ implementation(libs.commons.compress) {
+ because(
+ "commons-compress 1.26.1 (pinned by Hadoop 3.5.0) is below the 1.27.0 fix boundary" +
+ " for CVE-2024-25710 and CVE-2024-26308",
Review Comment:
@KVRahul16 : if you need this fix, would you be able to validate it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org