You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2026/08/31 15:23:48 UTC
(pulsar) 02/04: [fix][sec][branch-4.x] Upgrade Thrift to 0.24.0 (#26438)
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 35d2705e4097c428d4afbf16d1744cd47a5acc7a
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Mon Aug 31 13:44:15 2026 +0300
[fix][sec][branch-4.x] Upgrade Thrift to 0.24.0 (#26438)
---
distribution/server/src/assemble/LICENSE.bin.txt | 2 +-
pom.xml | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 9a41c349c315..9d25cbc570e5 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -433,7 +433,7 @@ The Apache Software License, Version 2.0
* SnakeYaml -- org.yaml-snakeyaml-2.0.jar
* RocksDB - org.rocksdb-rocksdbjni-7.9.2.jar
* Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.45.0.jar
- * Apache Thrift - org.apache.thrift-libthrift-0.23.0.jar
+ * Apache Thrift - org.apache.thrift-libthrift-0.24.0.jar
* OkHttp3
- com.squareup.okhttp3-logging-interceptor-5.3.2.jar
- com.squareup.okhttp3-okhttp-5.3.2.jar
diff --git a/pom.xml b/pom.xml
index 64ea0e811685..d5f1ef3fa12f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -301,7 +301,7 @@ flexible messaging model and an intuitive client API.</description>
<ant.version>1.10.12</ant.version>
<seancfoley.ipaddress.version>5.5.0</seancfoley.ipaddress.version>
<disruptor.version>3.4.3</disruptor.version>
- <thrift.version>0.23.0</thrift.version>
+ <thrift.version>0.24.0</thrift.version>
<!-- zstd-jni is only used for testcase,
the core logic is switched to java implementation of zstd in org.apache.commons:commons-compress -->
@@ -1357,7 +1357,7 @@ flexible messaging model and an intuitive client API.</description>
</exclusions>
</dependency>
<!-- libthrift is a transitive dependency of distributedlog-core.
- libthrift 0.23.0 upgraded to jakarta.* and HttpComponents 5 deps for its HTTP/servlet
+ libthrift 0.23.0 and later upgraded to jakarta.* and HttpComponents 5 deps for its HTTP/servlet
transports, which distributedlog-core does not use (only TJSON/TMemory serialization is needed). !-->
<dependency>
<groupId>org.apache.thrift</groupId>