Skip to content

Fix parquet-avro vulnerability in io expansion service #34860

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
derrickaw wants to merge 1 commit into from
Closed

Fix parquet-avro vulnerability in io expansion service #34860

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions sdks/java/io/expansion-service/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ applyJavaNature(
configurations.runtimeClasspath {
// Pin kafka-clients version due to <3.4.0 missing auth callback classes.
resolutionStrategy.force 'org.apache.kafka:kafka-clients:3.9.0'

// Pin org.apache.parquet:parquet-avro to a non-vulnerable version compatible.
resolutionStrategy.force 'org.apache.parquet:parquet-avro:1.15.1'
Copy link
Contributor

@damccorm damccorm May 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know which dependenc(y|ies) currently cause parquet-avro to be installed? I'm in favor of the change, but it would be good for us to know this so that we can respond once the dependency is fixed. Once we figure out that dependency FOO is causing the lower version of parquet-avro to be installed, we should add a couple comments:

  1. A comment here mentioning that this can be removed once that dependency is upgraded and ./gradlew :sdks:java:io:expansion-service:dependencies --configuration runtimeClasspath | grep parquet-avro shows no entries
  2. A comment next to dependency FOO mentioning that this should be removed once that is upgraded to a version with a higher parquet-avro dependency.

Both should link to a tracking issue with context (e.g. like b287985 does)

Copy link
Collaborator Author

@derrickaw derrickaw May 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Its covered now by another PR - #35037

}

shadowJar {
Expand Down
Loading