From 5cfa0d05928a34559d403c43adeeed5f85a4877c Mon Sep 17 00:00:00 2001
From: Eunbin Son <thswlsqls@naver.com>
Date: Thu, 30 Jul 2026 15:29:12 +0900
Subject: [PATCH] [fs] Force CVE-patched commons-lang3 and snappy-java in
 hadoop-shaded-3.4

hadoop-common 3.4.2 pulls commons-lang3 3.17.0 (CVE-2025-48924) and
snappy-java 1.1.10.4 into the shaded jar. Pin both to the versions the
project already adopted, mirroring paimon-hadoop-shaded (#8560), and
correct the NOTICE entry for commons-lang3.

Generated-by: Claude Code
---
 paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml  | 12 ++++++++++++
 .../src/main/resources/META-INF/NOTICE               |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml b/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
index 0a042cd4e1f3..94749f888c4d 100644
--- a/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
+++ b/paimon-filesystems/paimon-hadoop-shaded-3.4/pom.xml
@@ -44,6 +44,18 @@
                 <artifactId>commons-beanutils</artifactId>
                 <version>${commons.beanutils.version}</version>
             </dependency>
+            <dependency>
+                <!-- Bumped for security purposes (CVE-2025-48924); aligns bundled version with NOTICE -->
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>3.18.0</version>
+            </dependency>
+            <dependency>
+                <!-- Bumped for security purposes; aligns bundled version with NOTICE -->
+                <groupId>org.xerial.snappy</groupId>
+                <artifactId>snappy-java</artifactId>
+                <version>${snappy.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE b/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
index ba61822fd8e9..814ba28142d5 100644
--- a/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
+++ b/paimon-filesystems/paimon-hadoop-shaded-3.4/src/main/resources/META-INF/NOTICE
@@ -20,7 +20,7 @@ This project bundles the following dependencies under the Apache Software Licens
 - commons-logging:commons-logging:1.1.3
 - org.apache.commons:commons-compress:1.21
 - org.apache.commons:commons-configuration2:2.1.1
-- org.apache.commons:commons-lang3:3.12.0
+- org.apache.commons:commons-lang3:3.18.0
 - org.apache.commons:commons-text:1.4
 - org.apache.hadoop.thirdparty:hadoop-shaded-guava:1.4.0
 - org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25:1.4.0