You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pinot.apache.org by xi...@apache.org on 2026/06/04 20:59:48 UTC
(pinot) branch release-1.5.1 updated (30456ef6f1e -> 165ab819b6e)
This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a change to branch release-1.5.1
in repository https://gitbox.apache.org/repos/asf/pinot.git
discard 30456ef6f1e [maven-release-plugin] prepare for next development iteration
discard 01e10f352b5 [maven-release-plugin] prepare release release-1.5.1-rc0
new 51a65ff39db Exclude embedded Jetty from Hadoop deps in pinot-orc/pinot-parquet (CVE-2026-2332) (#18659)
new 165ab819b6e Patch CVEs for 1.5.1: bouncycastle 1.84 via pulsar 4.0.10, commons-configuration2 2.15.0
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (30456ef6f1e)
\
N -- N -- N refs/heads/release-1.5.1 (165ab819b6e)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
pinot-broker/pom.xml | 2 +-
pinot-clients/pinot-cli/pom.xml | 2 +-
pinot-clients/pinot-java-client/pom.xml | 2 +-
pinot-clients/pinot-jdbc-client/pom.xml | 2 +-
pinot-clients/pom.xml | 2 +-
pinot-common/pom.xml | 2 +-
pinot-compatibility-verifier/pom.xml | 2 +-
pinot-connectors/pinot-flink-connector/pom.xml | 2 +-
pinot-connectors/pinot-spark-2-connector/pom.xml | 2 +-
pinot-connectors/pinot-spark-3-connector/pom.xml | 2 +-
pinot-connectors/pinot-spark-common/pom.xml | 2 +-
pinot-connectors/pom.xml | 2 +-
pinot-controller/pom.xml | 2 +-
pinot-core/pom.xml | 2 +-
pinot-dependency-verifier/pom.xml | 2 +-
pinot-distribution/pom.xml | 2 +-
pinot-integration-test-base/pom.xml | 2 +-
pinot-integration-tests/pom.xml | 2 +-
pinot-minion/pom.xml | 2 +-
pinot-perf/pom.xml | 2 +-
pinot-plugins/assembly-descriptor/pom.xml | 2 +-
.../pinot-batch-ingestion-common/pom.xml | 2 +-
.../pinot-batch-ingestion-hadoop/pom.xml | 2 +-
.../pinot-batch-ingestion-spark-2.4/pom.xml | 2 +-
.../pinot-batch-ingestion-spark-3/pom.xml | 2 +-
.../pinot-batch-ingestion-spark-base/pom.xml | 2 +-
.../pinot-batch-ingestion-standalone/pom.xml | 2 +-
pinot-plugins/pinot-batch-ingestion/pom.xml | 2 +-
.../pinot-environment/pinot-azure/pom.xml | 2 +-
pinot-plugins/pinot-environment/pom.xml | 2 +-
pinot-plugins/pinot-file-system/pinot-adls/pom.xml | 2 +-
pinot-plugins/pinot-file-system/pinot-gcs/pom.xml | 2 +-
pinot-plugins/pinot-file-system/pinot-hdfs/pom.xml | 2 +-
pinot-plugins/pinot-file-system/pinot-s3/pom.xml | 2 +-
pinot-plugins/pinot-file-system/pom.xml | 2 +-
.../pinot-input-format/pinot-arrow/pom.xml | 2 +-
.../pinot-input-format/pinot-avro-base/pom.xml | 2 +-
.../pinot-input-format/pinot-avro/pom.xml | 2 +-
.../pinot-input-format/pinot-clp-log/pom.xml | 2 +-
.../pinot-confluent-avro/pom.xml | 2 +-
.../pinot-confluent-json/pom.xml | 2 +-
.../pinot-confluent-protobuf/pom.xml | 2 +-
pinot-plugins/pinot-input-format/pinot-csv/pom.xml | 2 +-
.../pinot-input-format/pinot-json/pom.xml | 2 +-
pinot-plugins/pinot-input-format/pinot-orc/pom.xml | 2 +-
.../pinot-input-format/pinot-parquet/pom.xml | 2 +-
.../pinot-input-format/pinot-protobuf/pom.xml | 2 +-
.../pinot-input-format/pinot-thrift/pom.xml | 2 +-
pinot-plugins/pinot-input-format/pom.xml | 2 +-
.../pinot-metrics/pinot-compound-metrics/pom.xml | 2 +-
.../pinot-metrics/pinot-dropwizard/pom.xml | 2 +-
pinot-plugins/pinot-metrics/pinot-yammer/pom.xml | 2 +-
pinot-plugins/pinot-metrics/pom.xml | 2 +-
.../pinot-minion-builtin-tasks/pom.xml | 2 +-
pinot-plugins/pinot-minion-tasks/pom.xml | 2 +-
.../pinot-segment-uploader-default/pom.xml | 2 +-
pinot-plugins/pinot-segment-uploader/pom.xml | 2 +-
.../pinot-segment-writer-file-based/pom.xml | 2 +-
pinot-plugins/pinot-segment-writer/pom.xml | 2 +-
.../pinot-stream-ingestion/pinot-kafka-3.0/pom.xml | 2 +-
.../pinot-stream-ingestion/pinot-kafka-4.0/pom.xml | 2 +-
.../pinot-kafka-base/pom.xml | 2 +-
.../pinot-stream-ingestion/pinot-kinesis/pom.xml | 2 +-
.../pinot-stream-ingestion/pinot-pulsar/pom.xml | 2 +-
pinot-plugins/pinot-stream-ingestion/pom.xml | 2 +-
.../pinot-timeseries-m3ql/pom.xml | 2 +-
pinot-plugins/pinot-timeseries-lang/pom.xml | 2 +-
pinot-plugins/pom.xml | 2 +-
pinot-query-planner/pom.xml | 2 +-
pinot-query-runtime/pom.xml | 2 +-
pinot-segment-local/pom.xml | 2 +-
pinot-segment-spi/pom.xml | 2 +-
pinot-server/pom.xml | 2 +-
pinot-spi/pom.xml | 2 +-
pinot-timeseries/pinot-timeseries-planner/pom.xml | 2 +-
pinot-timeseries/pinot-timeseries-spi/pom.xml | 2 +-
pinot-timeseries/pom.xml | 2 +-
pinot-tools/pom.xml | 2 +-
pinot-udf-test/pom.xml | 2 +-
pom.xml | 78 +++++++++++++++++++++-
80 files changed, 154 insertions(+), 82 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
(pinot) 02/02: Patch CVEs for 1.5.1: bouncycastle 1.84 via pulsar 4.0.10, commons-configuration2 2.15.0
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a commit to branch release-1.5.1
in repository https://gitbox.apache.org/repos/asf/pinot.git
commit 165ab819b6e76e02b740330c4deef2821472cb52
Author: Xiang Fu <xi...@apache.org>
AuthorDate: Thu Jun 4 13:56:26 2026 -0700
Patch CVEs for 1.5.1: bouncycastle 1.84 via pulsar 4.0.10, commons-configuration2 2.15.0
- pulsar 4.0.9 -> 4.0.10 pulls bouncy-castle-bc 4.0.10 (bcprov/bcpkix/bcutil 1.84),
fixing CVE-2026-5598, CVE-2026-0636, CVE-2026-5588
- commons-configuration2 2.13.0 -> 2.15.0 fixes CVE-2026-45205
Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
pom.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index 2c4551785b2..ffb05a94de3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -197,7 +197,7 @@
<kafka3.version>3.9.2</kafka3.version>
<kafka4.version>4.1.1</kafka4.version>
<confluent.version>7.9.5</confluent.version>
- <pulsar.version>4.0.9</pulsar.version>
+ <pulsar.version>4.0.10</pulsar.version>
<flink.version>1.20.3</flink.version>
<!-- Apache Commons Libraries -->
@@ -207,7 +207,7 @@
<commons-compress.version>1.28.0</commons-compress.version>
<commons-math3.version>3.6.1</commons-math3.version>
<commons-csv.version>1.14.1</commons-csv.version>
- <commons-configuration2.version>2.13.0</commons-configuration2.version>
+ <commons-configuration2.version>2.15.0</commons-configuration2.version>
<commons-beanutils.version>1.11.0</commons-beanutils.version>
<commons-io.version>2.21.0</commons-io.version>
<commons-codec.version>1.21.0</commons-codec.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
(pinot) 01/02: Exclude embedded Jetty from Hadoop deps in pinot-orc/pinot-parquet (CVE-2026-2332) (#18659)
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangfu0 pushed a commit to branch release-1.5.1
in repository https://gitbox.apache.org/repos/asf/pinot.git
commit 51a65ff39dbc9ce4119ebcf15fe6243b8e2e753f
Author: Jhow <44...@users.noreply.github.com>
AuthorDate: Wed Jun 3 15:42:51 2026 -0700
Exclude embedded Jetty from Hadoop deps in pinot-orc/pinot-parquet (CVE-2026-2332) (#18659)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
pom.xml | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 72 insertions(+)
diff --git a/pom.xml b/pom.xml
index 9308dd132f8..2c4551785b2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1404,6 +1404,21 @@
<groupId>ch.qos.reload4j</groupId>
<artifactId>reload4j</artifactId>
</exclusion>
+ <!-- Hadoop pulls org.eclipse.jetty (and org.eclipse.jetty.websocket) for its embedded
+ HttpServer2 web UIs, which downstream Pinot modules never start. These leak into
+ runtime distributions and carry CVE-2026-2332 (jetty-http request smuggling). Exclude
+ centrally here so every module depending on Hadoop is covered by default. Note: this
+ does NOT strip the relocated Jetty bundled inside the hadoop-client-runtime uber-jar
+ (org.apache.hadoop.shaded.org.eclipse.jetty); that is handled by the maven-shade-plugin
+ filter further down in this pom. -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.eclipse.jetty.websocket</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -1424,6 +1439,15 @@
<groupId>ch.qos.reload4j</groupId>
<artifactId>reload4j</artifactId>
</exclusion>
+ <!-- See hadoop-common above: drop embedded-Jetty web UI transitives (CVE-2026-2332). -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.eclipse.jetty.websocket</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -1436,6 +1460,17 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-reload4j</artifactId>
</exclusion>
+ <!-- See hadoop-common above: drop embedded-Jetty web UI transitives (CVE-2026-2332).
+ For hadoop-client the compile-scoped leak path is
+ hadoop-yarn-client -> websocket-client -> jetty-client -> jetty-http. -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.eclipse.jetty.websocket</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -1476,6 +1511,15 @@
<groupId>ch.qos.reload4j</groupId>
<artifactId>reload4j</artifactId>
</exclusion>
+ <!-- See hadoop-common above: drop embedded-Jetty web UI transitives (CVE-2026-2332). -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.eclipse.jetty.websocket</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -1483,6 +1527,17 @@
<artifactId>hadoop-hdfs-client</artifactId>
<version>${hadoop.version}</version>
<scope>provided</scope>
+ <exclusions>
+ <!-- See hadoop-common above: drop embedded-Jetty web UI transitives (CVE-2026-2332). -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.eclipse.jetty.websocket</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
@@ -2959,6 +3014,23 @@
<exclude>src/main/java/org/apache/pinot/core/transport/NettyInstance.java</exclude>
</excludes>
</filter>
+ <filter>
+ <!-- hadoop-client-runtime is a Hadoop uber-jar that bundles its own relocated Jetty
+ (org.apache.hadoop.shaded.org.eclipse.jetty). It exists only for Hadoop's embedded
+ HttpServer2 web UIs, which Pinot input-format / filesystem plugins never start, so
+ the classes are unreachable, but the leftover jetty-* Maven metadata still makes
+ scanners flag CVE-2026-2332 (jetty-http request smuggling). A Maven exclusion
+ cannot remove these because the classes are baked into the uber-jar rather than
+ resolved as a dependency node, so strip them from any shaded jar here. -->
+ <artifact>org.apache.hadoop:hadoop-client-runtime</artifact>
+ <excludes>
+ <exclude>org/apache/hadoop/shaded/org/eclipse/jetty/**</exclude>
+ <exclude>META-INF/maven/org.eclipse.jetty/**</exclude>
+ <exclude>META-INF/maven/org.eclipse.jetty.websocket/**</exclude>
+ <!-- ServiceLoader entries whose implementation classes are removed above. -->
+ <exclude>META-INF/services/org.apache.hadoop.shaded.org.eclipse.jetty.**</exclude>
+ </excludes>
+ </filter>
</filters>
<relocations>
<relocation>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org