From 3e1bc07314ed4fef7e59c3ae2d21dca2118f27ef Mon Sep 17 00:00:00 2001 From: Madhavendra Rathore Date: Wed, 29 Jul 2026 00:19:45 +0530 Subject: [PATCH 1/3] Bump security-affected dependencies (jackson, lz4-java, netty, httpcore5) Resolves OSV-Scanner findings and issue #1584: - jackson-databind/core/annotations 2.18.8 -> 2.18.9 (CVE-2026-54515, CVE-2026-59889, GHSA-mhm7-754m-9p8w) - lz4-java 1.10.1 -> 1.11.1 (CVE-2026-59949) - netty-buffer/netty-common 4.2.13.Final -> 4.2.15.Final (#1584) - httpcore5 5.3.6 -> 5.4.3 and pin transitive httpcore5-h2 to 5.4.3 via dependencyManagement (CVE-2026-54399, CVE-2026-54428; #1584). httpclient5 stays 5.5.2, which is compatible with the httpcore5 5.4.x branch. Verified: clean build embeds the fixed versions in the uber jar; OSV-Scanner reports zero findings; integration tests pass (SQL_EXEC 241, THRIFT_SERVER 189, 0 failures/errors). Co-authored-by: Isaac Signed-off-by: Madhavendra Rathore --- NEXT_CHANGELOG.md | 4 ++++ pom.xml | 17 +++++++++++++---- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md index fcecbbce3..52620697f 100644 --- a/NEXT_CHANGELOG.md +++ b/NEXT_CHANGELOG.md @@ -6,6 +6,10 @@ ### Updated - `DatabaseMetaData.getColumns(...)` with a `null` catalog now issues a single `SHOW COLUMNS IN ALL CATALOGS` statement (consistent with `getSchemas`/`getTables`) instead of enumerating every catalog and issuing a per-catalog `SHOW COLUMNS`. Older DBR versions that do not support the syntax transparently fall back to the previous enumerate-and-fan-out behavior. +- Bumped `jackson-databind` (and `jackson-core`/`jackson-annotations`) from 2.18.8 to 2.18.9 to resolve CVE-2026-54515, CVE-2026-59889, and GHSA-mhm7-754m-9p8w (`@JsonView`/`@JsonIgnoreProperties` deserialization bypasses). +- Bumped `lz4-java` from 1.10.1 to 1.11.1 to resolve CVE-2026-59949 (native XXHash JVM crash on invalid byte-array ranges). +- Bumped shaded `netty-buffer`/`netty-common` from 4.2.13.Final to 4.2.15.Final (Netty security release). Addresses issue #1584. +- Bumped Apache `httpcore5` from 5.3.6 to 5.4.3 and pinned the transitive `httpcore5-h2` (HTTP/2 HPACK decoder) to 5.4.3 to resolve CVE-2026-54399 (HTTP/1.1 parser DoS) and CVE-2026-54428 (HPACK header-list-size enforcement). `httpclient5` stays at 5.5.2, which is compatible with the httpcore5 5.4.x branch. Addresses issue #1584. ### Fixed - Invalid or incomplete Databricks JDBC URLs now fail with a descriptive `DatabricksSQLException` diff --git a/pom.xml b/pom.xml index 600f6da7d..b46df1c45 100644 --- a/pom.xml +++ b/pom.xml @@ -72,17 +72,17 @@ 0.118.0 4.5.14 5.5.2 - 5.3.6 + 5.4.3 0.23.0 2.0.13 - 2.18.8 + 2.18.9 2.13.2 33.0.0-jre 3.0.1 2.9.2 - 1.10.1 + 1.11.1 1.3.5 - 4.2.13.Final + 4.2.15.Final 1.71.0 1.20.0 1.7.0 @@ -121,6 +121,15 @@ gson ${gson.version} + + + org.apache.httpcomponents.core5 + httpcore5-h2 + ${httpcore5.version} + From dca5436e0efd9ceac0dd0efcba076125c4f75ccf Mon Sep 17 00:00:00 2001 From: Sreekanth Vadigi Date: Tue, 25 Aug 2026 21:15:55 +0000 Subject: [PATCH 2/3] Upgrade HttpClient instead of pinning HttpCore H2 Use HttpClient 5.6.3 so its supported HttpCore 5.4.3 dependency set resolves naturally, while retaining the security fixes and simplifying the changelog. Signed-off-by: Sreekanth Vadigi --- NEXT_CHANGELOG.md | 5 +---- pom.xml | 11 +---------- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md index 52620697f..1cb21bb09 100644 --- a/NEXT_CHANGELOG.md +++ b/NEXT_CHANGELOG.md @@ -6,10 +6,7 @@ ### Updated - `DatabaseMetaData.getColumns(...)` with a `null` catalog now issues a single `SHOW COLUMNS IN ALL CATALOGS` statement (consistent with `getSchemas`/`getTables`) instead of enumerating every catalog and issuing a per-catalog `SHOW COLUMNS`. Older DBR versions that do not support the syntax transparently fall back to the previous enumerate-and-fan-out behavior. -- Bumped `jackson-databind` (and `jackson-core`/`jackson-annotations`) from 2.18.8 to 2.18.9 to resolve CVE-2026-54515, CVE-2026-59889, and GHSA-mhm7-754m-9p8w (`@JsonView`/`@JsonIgnoreProperties` deserialization bypasses). -- Bumped `lz4-java` from 1.10.1 to 1.11.1 to resolve CVE-2026-59949 (native XXHash JVM crash on invalid byte-array ranges). -- Bumped shaded `netty-buffer`/`netty-common` from 4.2.13.Final to 4.2.15.Final (Netty security release). Addresses issue #1584. -- Bumped Apache `httpcore5` from 5.3.6 to 5.4.3 and pinned the transitive `httpcore5-h2` (HTTP/2 HPACK decoder) to 5.4.3 to resolve CVE-2026-54399 (HTTP/1.1 parser DoS) and CVE-2026-54428 (HPACK header-list-size enforcement). `httpclient5` stays at 5.5.2, which is compatible with the httpcore5 5.4.x branch. Addresses issue #1584. +- Updated bundled Jackson, lz4-java, Netty, and Apache HttpComponents Client and Core dependencies to patched versions. ### Fixed - Invalid or incomplete Databricks JDBC URLs now fail with a descriptive `DatabricksSQLException` diff --git a/pom.xml b/pom.xml index b46df1c45..e2731bf6b 100644 --- a/pom.xml +++ b/pom.xml @@ -71,7 +71,7 @@ 2.14.0 0.118.0 4.5.14 - 5.5.2 + 5.6.3 5.4.3 0.23.0 2.0.13 @@ -121,15 +121,6 @@ gson ${gson.version} - - - org.apache.httpcomponents.core5 - httpcore5-h2 - ${httpcore5.version} - From b4c8e244c9c4ff75d54e89fdeaf5549d8130288b Mon Sep 17 00:00:00 2001 From: Sreekanth Vadigi Date: Tue, 25 Aug 2026 21:16:42 +0000 Subject: [PATCH 3/3] Clarify security dependency changelog entry State explicitly that the bundled dependency upgrades address security findings. Signed-off-by: Sreekanth Vadigi --- NEXT_CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md index 1cb21bb09..dcc3e4e54 100644 --- a/NEXT_CHANGELOG.md +++ b/NEXT_CHANGELOG.md @@ -6,7 +6,7 @@ ### Updated - `DatabaseMetaData.getColumns(...)` with a `null` catalog now issues a single `SHOW COLUMNS IN ALL CATALOGS` statement (consistent with `getSchemas`/`getTables`) instead of enumerating every catalog and issuing a per-catalog `SHOW COLUMNS`. Older DBR versions that do not support the syntax transparently fall back to the previous enumerate-and-fan-out behavior. -- Updated bundled Jackson, lz4-java, Netty, and Apache HttpComponents Client and Core dependencies to patched versions. +- Updated bundled Jackson, lz4-java, Netty, and Apache HttpComponents Client and Core dependencies to patched versions to address security findings. ### Fixed - Invalid or incomplete Databricks JDBC URLs now fail with a descriptive `DatabricksSQLException`