You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "zml1206 (via GitHub)" <gi...@apache.org> on 2026/07/15 02:35:19 UTC
[PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
zml1206 opened a new pull request, #57266:
URL: https://github.com/apache/spark/pull/57266
### What changes were proposed in this pull request?
This pr upgrade janino from 3.1.9 to 3.1.12.
### Why are the changes needed?
Janino 3.1.9 and earlier are affected by [CVE-2023-33546](https://nvd.nist.gov/vuln/detail/cve-2023-33546), a disputed DoS issue where deeply nested user-supplied input can trigger a `StackOverflowError` in Janino parser APIs such as `ExpressionEvaluator.guessParameterNames`. Although Spark SQL codegen uses Janino through `ClassBodyEvaluator` rather than that specific API, upgrading removes the vulnerable dependency version reported by dependency scanners and picks up Janino's parser/codegen robustness fixes.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
No.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "zml1206 (via GitHub)" <gi...@apache.org>.
zml1206 commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-5279152002
> @zml1206 Please rebase the code. I will merge this PR once the CI passes again.
Rebased and CI passed. @LuciferYang
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang closed pull request #57266: [SPARK-58134][BUILD] Upgrade janino to 3.1.12
URL: https://github.com/apache/spark/pull/57266
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "cloud-fan (via GitHub)" <gi...@apache.org>.
cloud-fan commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-4979132038
do we have a summary of the release notes between 3.1.9 and 3.1.12? janino is a sensitive and critical dependency to Spark SQL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-5279186835
Thank you @zml1206 and all
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "zml1206 (via GitHub)" <gi...@apache.org>.
zml1206 commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-4979317980
> do we have a summary of the release notes between 3.1.9 and 3.1.12? janino is a sensitive and critical dependency to Spark SQL
https://janino-compiler.github.io/janino/changelog.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-4979075992
cc @cloud-fan
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-4993223586
I'm not sure that we need this (as an exception) in old branches. I'd prefer to put this on Spark 5 only according to our recent policy, @cloud-fan . Netty has a ton of CVEs, but we didn't backport at all.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-5279181196
**Merge Summary:**
- merged into master https://github.com/apache/spark/commit/ebd6a6988c6e701f881ad8cddd7d2c72c5529700
*Posted by `merge_spark_pr.py`*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-5276912537
@zml1206 Please rebase the code. I will merge this PR once the CI passes again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58134][BUILD] Upgrade janino to 3.1.12 [spark]
Posted by "cloud-fan (via GitHub)" <gi...@apache.org>.
cloud-fan commented on PR #57266:
URL: https://github.com/apache/spark/pull/57266#issuecomment-4993157044
cc @dongjoon-hyun , how far shall we backport? It claims to fix a CVE.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org