You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2026/04/21 21:06:23 UTC
(pulsar) branch branch-3.0 updated (e0a10a44538 -> d7a4814e603)
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a change to branch branch-3.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
from e0a10a44538 [fix][io] Restore lz4 compression with Kafka IO connector after #25198 exclusion
new 6de69534a15 [fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (#24935)
new d7a4814e603 [fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (#25198)
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
pom.xml | 7 +++++++
pulsar-common/pom.xml | 3 +--
pulsar-io/debezium/core/pom.xml | 4 ++++
pulsar-io/kafka-connect-adaptor/pom.xml | 4 ++++
pulsar-io/kafka/pom.xml | 4 ++++
pulsar-io/kinesis-kpl-shaded/pom.xml | 12 ++++++++++++
pulsar-io/kinesis/pom.xml | 6 ++++++
7 files changed, 38 insertions(+), 2 deletions(-)
(pulsar) 02/02: [fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (#25198)
Posted by lh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-3.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit d7a4814e603d7b945abbb3d147be391c218c1745
Author: guptas6est <sa...@est.tech>
AuthorDate: Mon Feb 2 21:59:58 2026 +0530
[fix][sec] Exclude org.lz4:lz4-java and standardize on at.yawk.lz4-java to remediate CVE-2025-12183 and CVE-2025-66566 (#25198)
(cherry picked from commit c07f2adbaccc34c05bfbb895889f464fa9cc495f)
---
pom.xml | 7 +++++++
pulsar-common/pom.xml | 3 +--
pulsar-io/debezium/core/pom.xml | 4 ++++
pulsar-io/kafka-connect-adaptor/pom.xml | 4 ++++
pulsar-io/kafka/pom.xml | 4 ++++
pulsar-io/kinesis-kpl-shaded/pom.xml | 6 ++++++
pulsar-io/kinesis/pom.xml | 6 ++++++
7 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index 7507b9fff1f..1ef8e08520a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -316,6 +316,7 @@ flexible messaging model and an intuitive client API.</description>
<roaringbitmap.version>1.2.0</roaringbitmap.version>
<extra-enforcer-rules.version>1.6.1</extra-enforcer-rules.version>
<oshi.version>6.4.0</oshi.version>
+ <lz4java.version>1.10.3</lz4java.version>
</properties>
<dependencyManagement>
@@ -1569,6 +1570,12 @@ flexible messaging model and an intuitive client API.</description>
<version>${restassured.version}</version>
<scope>test</scope>
</dependency>
+
+ <dependency>
+ <groupId>at.yawk.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ <version>${lz4java.version}</version>
+ </dependency>
</dependencies>
</dependencyManagement>
diff --git a/pulsar-common/pom.xml b/pulsar-common/pom.xml
index 11474810493..f1254bb6dd8 100644
--- a/pulsar-common/pom.xml
+++ b/pulsar-common/pom.xml
@@ -214,9 +214,8 @@
</dependency>
<dependency>
- <groupId>org.lz4</groupId>
+ <groupId>at.yawk.lz4</groupId>
<artifactId>lz4-java</artifactId>
- <version>1.5.0</version>
<scope>test</scope>
</dependency>
diff --git a/pulsar-io/debezium/core/pom.xml b/pulsar-io/debezium/core/pom.xml
index 5f0badc3501..84fd14846b9 100644
--- a/pulsar-io/debezium/core/pom.xml
+++ b/pulsar-io/debezium/core/pom.xml
@@ -75,6 +75,10 @@
<artifactId>jose4j</artifactId>
<groupId>org.bitbucket.b_c</groupId>
</exclusion>
+ <exclusion>
+ <groupId>org.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ </exclusion>
</exclusions>
</dependency>
diff --git a/pulsar-io/kafka-connect-adaptor/pom.xml b/pulsar-io/kafka-connect-adaptor/pom.xml
index 63372a94972..7faa3ad4e3a 100644
--- a/pulsar-io/kafka-connect-adaptor/pom.xml
+++ b/pulsar-io/kafka-connect-adaptor/pom.xml
@@ -77,6 +77,10 @@
<artifactId>jose4j</artifactId>
<groupId>org.bitbucket.b_c</groupId>
</exclusion>
+ <exclusion>
+ <groupId>org.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ </exclusion>
</exclusions>
</dependency>
diff --git a/pulsar-io/kafka/pom.xml b/pulsar-io/kafka/pom.xml
index 354e8553024..a0c88fad9fe 100644
--- a/pulsar-io/kafka/pom.xml
+++ b/pulsar-io/kafka/pom.xml
@@ -89,6 +89,10 @@
<artifactId>jose4j</artifactId>
<groupId>org.bitbucket.b_c</groupId>
</exclusion>
+ <exclusion>
+ <groupId>org.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ </exclusion>
</exclusions>
</dependency>
diff --git a/pulsar-io/kinesis-kpl-shaded/pom.xml b/pulsar-io/kinesis-kpl-shaded/pom.xml
index c8376c0485d..effaaaa10a2 100644
--- a/pulsar-io/kinesis-kpl-shaded/pom.xml
+++ b/pulsar-io/kinesis-kpl-shaded/pom.xml
@@ -58,6 +58,12 @@
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-clients</artifactId>
<version>${kafka-client.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>org.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
</dependencies>
</dependencyManagement>
diff --git a/pulsar-io/kinesis/pom.xml b/pulsar-io/kinesis/pom.xml
index d5642d6a4ff..32676c5bb45 100644
--- a/pulsar-io/kinesis/pom.xml
+++ b/pulsar-io/kinesis/pom.xml
@@ -44,6 +44,12 @@
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-clients</artifactId>
<version>${kafka-client.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>org.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
</dependencies>
</dependencyManagement>
(pulsar) 01/02: [fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (#24935)
Posted by lh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-3.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 6de69534a15dcd64fc909ffae024966e149e6de3
Author: guptas6est <sa...@est.tech>
AuthorDate: Mon Nov 3 15:57:04 2025 +0000
[fix][sec] Override kafka-clients in kinesis-kpl-shaded to remediate CVE-2024-31141 and CVE-2025-27817 (#24935)
(cherry picked from commit 8cb1040336e8a397ff60220842102c99f712348b)
---
pulsar-io/kinesis-kpl-shaded/pom.xml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/pulsar-io/kinesis-kpl-shaded/pom.xml b/pulsar-io/kinesis-kpl-shaded/pom.xml
index 7d62457643b..c8376c0485d 100644
--- a/pulsar-io/kinesis-kpl-shaded/pom.xml
+++ b/pulsar-io/kinesis-kpl-shaded/pom.xml
@@ -53,6 +53,12 @@
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- enforce kafka client version that gets pulled transitively -->
+ <dependency>
+ <groupId>org.apache.kafka</groupId>
+ <artifactId>kafka-clients</artifactId>
+ <version>${kafka-client.version}</version>
+ </dependency>
</dependencies>
</dependencyManagement>
<dependencies>