Skip to content

Fix blocking security scan findings on main #1663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sreekanth-db merged 3 commits into from
Aug 25, 2026
Merged

Fix blocking security scan findings on main #1663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3e1bc07
Bump security-affected dependencies (jackson, lz4-java, netty, httpco…
msrathore-db Jul 28, 2026
dca5436
Upgrade HttpClient instead of pinning HttpCore H2
sreekanth-db Aug 25, 2026
b4c8e24
Clarify security dependency changelog entry
sreekanth-db Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions NEXT_CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

### Updated
- `DatabaseMetaData.getColumns(...)` with a `null` catalog now issues a single `SHOW COLUMNS IN ALL CATALOGS` statement (consistent with `getSchemas`/`getTables`) instead of enumerating every catalog and issuing a per-catalog `SHOW COLUMNS`. Older DBR versions that do not support the syntax transparently fall back to the previous enumerate-and-fan-out behavior.
- Updated bundled Jackson, lz4-java, Netty, and Apache HttpComponents Client and Core dependencies to patched versions to address security findings.

### Fixed
- Invalid or incomplete Databricks JDBC URLs now fail with a descriptive `DatabricksSQLException`
Expand Down
10 changes: 5 additions & 5 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,18 +71,18 @@
<commons-io.version>2.14.0</commons-io.version>
<databricks-sdk.version>0.118.0</databricks-sdk.version>
<httpclient.version>4.5.14</httpclient.version>
<async-httpclient.version>5.5.2</async-httpclient.version>
<httpcore5.version>5.3.6</httpcore5.version>
<async-httpclient.version>5.6.3</async-httpclient.version>
<httpcore5.version>5.4.3</httpcore5.version>
Comment thread
sreekanth-db marked this conversation as resolved.
<thrift.version>0.23.0</thrift.version>
<slf4j.version>2.0.13</slf4j.version>
<jackson.version>2.18.8</jackson.version>
<jackson.version>2.18.9</jackson.version>
<gson.version>2.13.2</gson.version>
<google.guava.version>33.0.0-jre</google.guava.version>
<google.findbugs.annotations.version>3.0.1</google.findbugs.annotations.version>
<immutables.value.version>2.9.2</immutables.value.version>
<lz4-compression.version>1.10.1</lz4-compression.version>
<lz4-compression.version>1.11.1</lz4-compression.version>
<annotation.version>1.3.5</annotation.version>
<netty.version>4.2.13.Final</netty.version>
<netty.version>4.2.15.Final</netty.version>
<grpc.version>1.71.0</grpc.version>
<jts-core.version>1.20.0</jts-core.version>
<resilience4j.version>1.7.0</resilience4j.version>
Expand Down
Loading