Acceldata
 ODP
Search documentation… ⌘K

Last updated: Oct 15, 2026 15:28 UTC

Fixed CVEs

This release resolves xsecurity vulnerabilities (CVEs) identified across ODP platform components, representing a comprehensive security hardening initiative implemented during the upgrade from version 3.3.6.5-1 to 3.4.3.0-1.

Detailed List of CVE Fixes

For detailed information about CVEs addressed in this release, see ODP 3.4.3.0-1 CVE Fixes.

You can see the summary of CVEs addressed by components and severity level.

CVE Fix Descriptions

Airflow

  • OSV-37942: Upgraded Tornado to version 6.5.8.
  • OSV-37962: Upgraded sqlparse to version 0.6.0.
  • OSV-37966: Upgraded Soup Sieve to version 2.8.4.
  • OSV-37939: Upgraded LiteLLM to version 1.84.0.
  • OSV-37964: Upgraded joserfc to version 1.6.8.
  • OSV-37926: Upgraded cryptography to version 50.0.0.
  • OSV-37923: Upgraded apache-airflow-providers-ftp to version 3.15.1.
  • OSV-37963: Upgraded aiohttp to version 3.14.3.

Atlas

  • OSV-36790: Upgraded the PostgreSQL JDBC driver to version 42.7.12.
  • OSV-36788: Upgraded Jackson to version 2.18.8.
  • ATLAS-5353: Upgraded Netty to version 4.2.15.Final.

Celeborn

  • OSV-38062: Added Netty 4.2 native classifier versions to dependencyManagement.
  • OSV-38002: Upgraded Apache HTTPCore5 to version 5.4.3.
  • OSV-38056: Upgraded Jackson to version 2.18.8.
  • OSV-38024 | CELEBORN-2326: Upgraded log4j-core to version 2.25.4.
  • OSV-38062: Upgraded Netty to version 4.2.17.Final.
  • OSV-38062 | CELEBORN-2258: Upgraded Netty from version 4.1.118.Final to 4.2.10.Final.

Flink

  • FLINK-40071: Upgraded jackson-bom to version 2.22.2.
  • FLINK-40565: Upgraded Netty to version 4.2.17.
  • FLINK-40527: Updated flink-shaded to version 22.0.
  • FLINK-40053: Updated Log4j to version 2.26.1.
  • FLINK-39146: Updated Log4j to version 2.25.3.
  • FLINK-38903: Updated flink-shaded to version 21.0.

Hadoop

  • OSV-37126 | CVE-2026-56740: Upgraded JLine to version 3.30.14 to address a high-severity vulnerability.
  • OSV-37068 | CVE-2025-48734: Excluded the commons-beanutils:commons-beanutils version 1.9.2 dependency to address a high-severity vulnerability.
  • OSV-37096 | HADOOP-19761: Added a Jetty exception.
  • HADOOP-19956: Upgraded lz4-java to version 1.11.2 to address security vulnerabilities.
  • HADOOP-19967: Upgraded Jackson to version 2.18.10 to address security vulnerabilities.
  • HADOOP-19939: Upgraded Jackson to version 2.18.9 to address security vulnerabilities.
  • HADOOP-19913: Upgraded Jackson to version 2.18.8.
  • HADOOP-19831: Upgraded Jackson to version 2.18.6 to address security vulnerabilities.
  • HADOOP-19544: Upgraded Jackson to version 2.18.5.
  • HADOOP-19259: Upgraded Jackson to version 2.14.3.
  • HADOOP-19957: Upgraded Netty to version 4.1.137 to address security vulnerabilities.
  • HADOOP-19919 | CVE-2026-44249: Upgraded Netty to version 4.1.135 to address the vulnerability.
  • HADOOP-19878: Upgraded Netty to version 4.1.113.Final to address security vulnerabilities.
  • HADOOP-19788: Updated the Netty dependency to version 4.1.130.Final.
  • HADOOP-19761: Upgraded Jetty and http2-common to version 9.4.58.v20250814.

HBase

  • HBASE-29740: Upgraded lz4-java to version 1.8.1 or later.
  • ODP-7851: Restored Jackson to version 2.19.2.
  • HBASE-30311: Upgraded lz4-java from version 1.10.4 to 1.11.1.
  • Upgraded lz4-java to version 1.10.4.
  • HBASE-30333: Upgraded Log4j 2 from version 2.25.4 to 2.26.1.
  • Upgraded Log4j 2 to version 2.25.4.
  • Upgraded Netty to version 4.1.136.Final.
  • HBASE-30088: Upgraded org.bouncycastle:bcpkix-jdk18on from version 1.81 to 1.84.
  • HBASE-29971: Upgraded hbase-thirdparty to version 4.1.13.
  • HBASE-29928: Upgraded io.airlift:aircompressor from version 0.27 to 2.0.3.

Hive

  • OSV-36241: Upgraded commons-vfs2, grpc-netty-shaded, and json-smart to address three CVEs.
  • OSV-36238: Upgraded Aircompressor to version 2.0.3 to address a CVE.
  • ODP-7844: Upgraded Netty to version 4.1.137.Final for version alignment.
  • OSV-36239: Upgraded Jackson to version 2.18.8 to address a CVE.
  • OSV-36198: Upgraded Log4j to version 2.25.4 to address four CVEs.
  • OSV-36248: Upgraded Netty to version 4.1.135.Final to address 34 CVEs.

Hue

  • Reverted the Mako upgrade because of a dependency conflict with djangomako.
  • OSV-35995: Upgraded Django to version 4.2.30.
  • OSV-36014: Upgraded Thrift to version 0.24.0.
  • OSV-36019: Upgraded cryptography to version 50.0.1.
  • OSV-36020: Upgraded PyJWT to version 2.12.0.
  • OSV-36023: Upgraded urllib3 to version 2.7.0.
  • OSV-36017: Upgraded Mako to version 1.3.12.
  • OSV-36026: Upgraded sqlparse to version 0.5.4.

Impala

  • OSV-37353: Fixed Avro version compatibility for Python 2 and Python 3.
  • OSV-37353: Updated setuptools to a newer version for Python 3.
  • OSV-37353: Added conditional Thrift version selection based on the Python version.
  • OSV-37353: Downgraded Thrift.
  • OSV-37353: Upgraded Python test and infrastructure dependencies.
  • OSV-37353: Upgraded Python Thrift to version 0.24.0.
  • OSV-37276: Upgraded the PostgreSQL JDBC driver to version 42.7.11.
  • OSV-37265: Upgraded Aircompressor to version 2.0.3.
  • OSV-37158: Upgraded Guava to version 32.1.2-jre.
  • OSV-37192: Upgraded Log4j 2 to version 2.25.4.
  • OSV-37247: Upgraded Jackson to version 2.18.1.

JupyterHub

  • OSV-38213, OSV-38214, OSV-38215, OSV-38216, OSV-38217, OSV-38218, OSV-38219, OSV-38220, OSV-38221, OSV-38222, OSV-38223, OSV-38224, OSV-38225, OSV-38226, OSV-38212: Upgraded GitPython to version 3.1.59.
  • OSV-38205 | OSV-38206 | OSV-38207: Upgraded sqlparse to version 0.6.0.
  • OSV-38209 | OSV-38201: Upgraded aiohttp to version 3.14.3.
  • OSV-38203 | OSV-38204: Upgraded JupyterLab to version 4.6.2.
  • OSV-38211: Upgraded cryptography to version 50.0.0.
  • OSV-38202: Upgraded Tornado to version 6.5.8.
  • OSV-38208: Replaced the patched FontTools fork with upstream version 4.60.2.

Kafka 3

  • OSV-37387: Upgraded JLine to version 3.30.16.
  • OSV-37408: Upgraded Netty to version 4.1.136.Final.
  • OSV-37410 | KAFKA-21004: Upgraded Jackson to version 2.21.6.
  • OSV-37409 | KAFKA-20773: Upgraded Jackson to version 2.21.5.
  • OSV-37409: Upgraded Jackson to version 2.21.4.
  • OSV-37410: Upgraded Jackson to version 2.21.2.
  • OSV-37369 | KAFKA-20241: Upgraded Jackson to version 2.21.1.
  • OSV-37381: Updated Jackson to version 2.20.1 and jackson-annotations to version 2.20.
  • OSV-37409: Updated Jackson to version 2.19.2.
  • OSV-37410 | KAFKA-19336: Upgraded Jackson to version 2.19.0.

Knox

  • OSV-36300 | CVE-2026-69220: Upgraded Metrics to version 4.2.40.
  • OSV-36297 | CVE-2026-56740: Upgraded org.jline:jline-remote-telnet to version 3.30.14.
  • KNOX-3377 | KNOX-3378 | KNOX-3379: Added secure LDAP (LDAPS) support for the Knox embedded LDAP service.
  • Upgraded Apache Directory API to version 2.1.8.
  • KNOX-3344: Upgraded pac4j to version 6.5.3.
  • KNOX-3217: Upgraded pac4j to version 6.3.0 for JDK 17 compatibility.
  • KNOX-3421: Upgraded Shiro to version 2.2.1.
  • KNOX-3428: Upgraded Spring to version 6.2.19 and added integration tests for the HashiCorp Vault alias service.
  • KNOX-3278: Updated JLine to version 3.30.6.
  • KNOX-2957: Updated Groovy to version 4.0.29.
  • Upgraded org.postgresql:postgresql from version 42.7.11 to 42.7.12.
  • KNOX-3322: Upgraded PostgreSQL to version 42.7.11 to address CVEs.
  • KNOX-3383: Upgraded Jackson to version 2.18.9 to address CVEs.
  • KNOX-3307: Upgraded jackson-core to version 2.18.6.
  • KNOX-3366: Upgraded mina-core to version 2.2.8.
  • Upgraded org.apache.mina:mina-core from version 2.2.4 to 2.2.7.
  • KNOX-3211: Upgraded mina-core to version 2.2.4.
  • KNOX-3339: Upgraded Log4j 2 to version 2.26.0.

Kudu

  • OSV-36323: Upgraded Log4j 2 to version 2.25.4 to address a security vulnerability.
  • OSV-38713: Upgraded Netty to version 4.1.137.Final.
  • OSV-36330: Upgraded Netty to version 4.1.135.Final.
  • OSV-36326: Updated Netty to version 4.1.131.Final.

MLflow

No CVE fixes.

NiFi 2

  • NIFI-15789: Upgraded Snowflake JDBC from version 3.28.0 to 4.0.2.
  • NIFI-16245: Upgraded Spring to version 7.0.9, Spring Security to version 7.1.1, Guava to version 33.7.1-jre, and other dependencies.
  • NIFI-16245: Upgraded Spring to version 7.0.9, Spring Security to version 7.1.1, Guava to version 33.7.1-jre, and other dependencies.
  • NIFI-16171: Upgraded Netty to version 4.2.17.Final, Jetty to version 12.1.12, and other dependencies.
  • NIFI-16106: Upgraded Bouncy Castle to version 1.85, Logback to version 1.5.38, Jackson to version 3.2.1, and other dependencies.
  • NIFI-16095: Upgraded Jetty to version 12.1.11, Jackson to version 2.22.1, and other dependencies.
  • NIFI-16083: Upgraded Netty to version 4.2.16.Final, Log4j 2 to version 2.26.1, Groovy to version 5.0.7, and other dependencies.
  • NIFI-16030: Upgraded Snowflake JDBC from version 4.3.0 to 4.3.1, HikariCP from version 7.0.2 to 7.1.0, and other dependencies.
  • NIFI-16007: Upgraded Spring to version 7.0.8, OkHTTP to version 5.4.0, Jackson to version 2.22.0, and other dependencies.
  • NIFI-15993: Upgraded Jetty to version 12.1.10, Netty to version 4.2.15.Final, Logback to version 1.5.34, and other dependencies.
  • NIFI-15986: Upgraded Apache Calcite to version 1.42.0, Apache ActiveMQ to version 6.2.6, Jackson to version 2.21.4, and other dependencies.
  • NIFI-15980: Upgraded Logback to version 1.5.33, Tika to version 3.3.1, SSHd to version 2.18.0, and other dependencies.
  • NIFI-15972: Upgraded Netty to version 4.2.14.Final, Azure to version 1.3.7, and Kafka to version 4.3.0.
  • NIFI-15915: Upgraded Netty to version 4.2.13.Final, Jetty to version 12.1.9, Groovy to version 5.0.6, and other dependencies.
  • NIFI-15899: Upgraded Commons Codec to version 1.22.0, Commons IO to version 2.22.0, Gson to version 2.14.0, and other dependencies.
  • NIFI-15871: Upgraded Spring Security to version 7.0.5, Testcontainers to version 2.0.5, and other dependencies.
  • NIFI-15858: Upgraded Spring to version 7.0.7, Maven to version 3.9.15, MySQL Binlog to version 0.40.7, and other dependencies.
  • NIFI-15762: Upgraded Log4j to version 2.25.4, GCP SDK to version 26.79.0, AWS SDK to version 2.42.23, and other dependencies.
  • NIFI-15752: Upgraded Netty to version 4.2.12.Final, ActiveMQ to version 6.2.2, Nimbus OAuth2 OIDC to version 11.35, and other dependencies.
  • NIFI-15740: Upgraded Tika to version 3.3.0, Jackson to version 2.21.2, Elasticsearch to version 9.3.2, and other dependencies.
  • NIFI-15721: Upgraded Spring Security to version 7.0.4, Kotlin to version 2.3.20, MySQL Binlog to version 0.40.6, and other dependencies.
  • NIFI-15713: Upgraded Apache Maven to version 3.9.14, Spring to version 7.0.6, Mockito to version 5.23.0, and other dependencies.
  • NIFI-15672: Upgraded AWS SDK to version 2.42.6, GCP SDK to version 26.77, Fabric8 Kubernetes to version 7.6.0, and other dependencies.
  • NIFI-15635: Upgraded Jackson to version 2.21.1, JSON Path to version 3.0.0, Nimbus JWT to version 10.8, and other dependencies.
  • NIFI-15623: Upgraded Spring to version 7.0.5, Kafka to version 4.2.0, ActiveMQ to version 6.2.1, and other dependencies.
  • NIFI-15607: Upgraded Spring Security to version 7.0.3, JUnit to version 6.0.3, Logback to version 1.5.32, and other dependencies.
  • NIFI-15585: Upgraded Spring to version 7.0.4, Logback to version 1.5.29, Box SDK to version 5.4.0, and other dependencies.

ODP Ambari

  • OSV-43999: Upgraded Commons IO to version 2.22.0.
  • OSV-44049: Upgraded Logback to version 1.5.38.
  • OSV-43909: Upgraded Spring to version 6.2.19 and Spring Security to version 6.5.11.
  • OSV-44044: Upgraded Jackson to version 2.18.9.
  • OSV-43692: Upgraded Netty to version 4.1.138.Final.
  • OSV-24211: Upgraded Spring Security to version 6.0.8 to address a CVE.
  • OSV-24224 | CVE-2026-41409: Upgraded Mina to version 2.0.28.
  • OSV-24206 | CVE-2024-38809: Upgraded Spring Framework to version 6.2.19.
  • OSV-24249 | CVE-2024-12798: Upgraded Logback to version 1.3.16.
  • OSV-24279 | CVE-2021-29425: Upgraded Commons IO to version 2.15.1.
  • OSV-24202 | CVE-2024-29131: Upgraded Commons Configuration2 to version 2.15.0.
  • OSV-24391 | CVE-2025-48924: Upgraded Commons Lang3 to version 3.18.0.
  • OSV-24214 | CVE-2025-53864: Upgraded Nimbus JOSE JWT to version 9.37.4.
  • OSV-24197 | CVE-2024-38829: Upgraded Spring LDAP to version 2.4.4.
  • OSV-24398 | CVE-2026-42198: Upgraded PostgreSQL JDBC to version 42.7.13.
  • OSV-24205 | GHSA-72hv-8253-57qq: Upgraded Jackson to version 2.18.6.
  • OSV-24198 | CVE-2026-41417: Upgraded Netty to version 4.1.135.Final.

Ozone

  • OSV-42714 | HDDS-16285: Upgraded Netty to version 4.1.137.

Pinot

  • ODP-7962 | OCR-2327: Added commons-logging to the dependency exclusions.
  • OSV-36939: Upgraded org.jline:jline from version 4.1.3 to 4.2.1.
  • OSV-36939: Upgraded org.jline:jline from version 4.1.2 to 4.1.3.
  • OSV-36939: Upgraded org.jline:jline from version 4.1.1 to 4.1.2.
  • OSV-36939: Upgraded org.jline:jline from version 4.1.0 to 4.1.1.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.15 to 4.1.0.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.14 to 4.0.15.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.13 to 4.0.14.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.12 to 4.0.13.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.10 to 4.0.12.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.9 to 4.0.10.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.8 to 4.0.9.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.7 to 4.0.8.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.5 to 4.0.7.
  • OSV-36939: Upgraded org.jline:jline from version 4.0.4 to 4.0.5.
  • OSV-36942: Upgraded com.fasterxml.jackson:jackson-bom from version 2.22.1 to 2.22.2.
  • OSV-36942: Upgraded com.fasterxml.jackson:jackson-bom from version 2.22.0 to 2.22.1.
  • OSV-36942: Upgraded com.fasterxml.jackson:jackson-bom from version 2.21.3 to 2.22.0.
  • OSV-36942: Upgraded com.fasterxml.jackson:jackson-bom from version 2.21.2 to 2.21.3.
  • OSV-36942: Upgraded com.fasterxml.jackson:jackson-bom from version 2.21.1 to 2.21.2.
  • OSV-36955: Upgraded org.apache.httpcomponents.core5:httpcore5 from version 5.4.2 to 5.4.3.
  • OSV-36941: Upgraded io.netty:netty-bom from version 4.1.136.Final to 4.1.137.Final.
  • OSV-36941: Upgraded io.netty:netty-bom from version 4.1.135.Final to 4.1.136.Final.
  • OSV-36941: Upgraded io.netty:netty-bom from version 4.1.134.Final to 4.1.135.Final.

Ranger

  • OSV-42008: Pinned transitive Netty and Jackson dependencies using netty-bom and jackson-bom.
  • OSV-41984: Upgraded OpenTelemetry to version 1.62.0.
  • OSV-42025: Upgraded Azure Identity to version 1.12.2.
  • OSV-42023: Upgraded Apache POI to version 5.4.0.
  • OSV-41924: Upgraded Nimbus JOSE JWT to version 10.0.2.
  • OSV-41929: Upgraded Commons Lang3 to version 3.19.0 in yunikorn-agent.
  • OSV-41923: Upgraded Commons Configuration2 to version 2.15.0.
  • OSV-41994: Upgraded Logback to version 1.3.16.
  • OSV-42070: Upgraded Log4j 2 to version 2.25.5.
  • OSV-42123: Upgraded Jackson to version 2.18.9 in yunikorn-agent.
  • OSV-37585: Upgraded the Jetty client to version 9.4.58.v20250814.
  • OSV-42007: Upgraded Netty to version 4.1.137.Final.
  • OSV-41973: Upgraded embedded Tomcat to version 9.0.121.
  • RANGER-5738: Upgraded Tomcat to version 9.0.120.
  • Upgraded com.fasterxml.jackson.core:jackson-databind from version 2.17.2 to 2.18.9.

Registry

  • OSV-38172: Upgraded Jackson to version 2.18.8.
  • ODP-7675: Excluded org.nodejs from the SciJava Maven repository.
  • ODP-7478: Updated Logback to version 1.2.13.
  • ODP-7386: Excluded multi-release JAR entries to fix shadowJar failures on Gradle 6.
  • OSV-22894 | CVE-2025-67030: Upgraded plexus-utils to version 3.6.1.
  • OSV-22868 | CVE-2025-53864: Upgraded nimbus-jose-jwt to version 10.0.2.
  • OSV-22896 | CVE-2026-42198: Upgraded PostgreSQL to version 42.7.11.
  • OSV-22882 | CVE-2025-48924: Upgraded commons-lang3 to version 3.18.0.
  • OSV-22874 | CVE-2024-12798 | CVE-2024-12801 | CVE-2025-11226: Upgraded Logback to version 1.3.16.
  • OSV-22879 | PRISMA-2023-0067: Upgraded Jackson to version 2.18.6.

Spark 3

  • ODP-7669: Upgraded grpc-java to version 1.65.1 to fix Spark Connect compatibility with Netty 4.1.111 and later.
  • SPARK-54269: Upgraded cloudpickle to version 3.1.2 for Python 3.14 compatibility.
  • SPARK-50823: Upgraded cloudpickle from version 3.1.0 to 3.1.1.
  • SPARK-50621: Upgraded cloudpickle to version 3.1.0.
  • SPARK-46080: Upgraded cloudpickle to version 3.0.0.
  • ODP-7930 | ODP-7894: Updated Hive to version 2.3.104.
  • OSV-37725 | CVE-2025-12183: Upgraded org.lz4:lz4-java to version 1.8.1.
  • SPARK-44811: Upgraded Guava to version 33.2.1-jre.
  • SPARK-49120: Upgraded Gson to version 2.11.0.
  • SPARK-56307: Upgraded Log4j to version 2.25.4.
  • SPARK-55130: Upgraded Log4j to version 2.25.3.
  • SPARK-50580: Upgraded Log4j 2 to version 2.24.3.
  • SPARK-50400: Upgraded Log4j 2 to version 2.24.2.
  • SPARK-49541: Upgraded Log4j 2 to version 2.24.1.
  • SPARK-46672: Upgraded Log4j 2 to version 2.22.1.
  • SPARK-46038: Upgraded Log4j 2 to version 2.22.0.
  • SPARK-45625: Upgraded Log4j to version 2.21.0.
  • Upgraded Jackson to version 2.18.8 to address remaining CVEs.
  • SPARK-56318: Upgraded Jackson to version 2.18.6.
  • SPARK-50452: Upgraded Jackson to version 2.18.2.
  • SPARK-50165: Upgraded Jackson to version 2.18.1.
  • SPARK-49826: Upgraded Jackson to version 2.18.0.
  • SPARK-48826: Upgraded Jackson to version 2.17.2.
  • SPARK-48198: Upgraded Jackson to version 2.17.1.
  • SPARK-47438: Upgraded Jackson to version 2.17.0.
  • SPARK-46508: Upgraded Jackson to version 2.16.1.
  • SPARK-45967: Upgraded Jackson to version 2.16.0.
  • Upgraded Netty to version 4.1.136.Final to address remaining CVEs.
  • SPARK-53599: Upgraded Netty to version 4.1.127.Final.
  • SPARK-53494: Upgraded Netty to version 4.1.126.Final.
  • SPARK-53436: Upgraded Netty to version 4.1.124.Final.
  • SPARK-52983: Upgraded Netty to version 4.1.123.Final.
  • SPARK-52438: Upgraded Netty to version 4.1.122.Final and netty-tcnative to version 2.0.72.Final.
  • SPARK-51944: Upgraded Netty to version 4.1.121.Final.
  • SPARK-51387: Upgraded Netty to version 4.1.119.Final.
  • SPARK-51193: Upgraded Netty to version 4.1.118.Final and netty-tcnative to version 2.0.70.Final.
  • SPARK-51054: Upgraded Netty to version 4.1.117.Final.
  • SPARK-50453: Upgraded Netty to version 4.1.115.
  • SPARK-48590: Upgraded Netty to version 4.1.114.Final.
  • SPARK-48420: Upgraded Netty to version 4.1.110.Final.
  • SPARK-47896: Upgraded Netty to version 4.1.109.Final.
  • SPARK-47526: Upgraded Netty to version 4.1.108.Final and netty-tcnative to version 2.0.65.Final.
  • SPARK-47100: Upgraded Netty to version 4.1.107.Final and netty-tcnative to version 2.0.62.Final.
  • SPARK-46432: Upgraded Netty to version 4.1.106.Final.
  • SPARK-45741: Upgraded Netty to version 4.1.100.Final.
  • SPARK-45376: Added the netty-tcnative-boringssl-static dependency.
  • SPARK-45382: Upgraded Netty to version 4.1.99.Final.

Tez

  • OSV-36101: Upgraded Netty to version 4.1.137.Final.
  • TEZ-4655: Upgraded Netty to version 4.1.130.Final.

Trino

  • ODP-7981: Reverted the Jetty CVE fix to version 12.1.9.
  • ODP-7981: Pinned jetty-server, jetty-util, jetty-jmx, jetty-http2-common, and jetty-http2-hpack to version 12.1.13 to fix Trino startup crashes.
  • ODP-7916: Fixed RequireUpperBoundDeps failures in trino-pinot.
  • OSV-37039: Upgraded Jetty IO to version 12.1.13.
  • OSV-37008: Fixed compilation and Maven sorting issues.
  • OSV-36973: Partially upgraded Jackson and Jetty.
  • OSV-36971: Upgraded the PostgreSQL JDBC driver to version 42.7.12.
  • OSV-37008: Upgraded Apache Thrift to version 0.24.0.
  • OSV-37030: Upgraded Apache HTTPCore5 to version 5.4.3.
  • OSV-37043: Updated Netty to version 4.2.18.Final.

Trino Gateway

  • OSV-38230: Upgraded Jetty to version 12.1.10.
  • OSV-38234: Upgraded Jackson to versions 2.21.4 and 3.1.4.
  • OSV-38231: Upgraded org.apache.mina:mina-core from version 2.2.7 to 2.2.8.

ZooKeeper

  • ZOOKEEPER-5086: Upgraded Netty to version 4.1.137.Final.
  • ZOOKEEPER-5077: Upgraded Netty to version 4.1.136.Final.
  • ZOOKEEPER-5056: Upgraded Netty to address CVE vulnerabilities.
  • ZOOKEEPER-5075: Upgraded JLine to version 3.30.14.
  • ZOOKEEPER-5083: Upgraded jackson-databind to version 2.22.2 to address known security vulnerabilities.
  • ZOOKEEPER-5064: Upgraded Jackson to version 2.18.8 to address CVEs.