Update parquet version in parquet-extensions to address security vulnerabilities
Open
Area - Dependencies
Security
- Dominant language
- Java
- Stars
- 14.1k
- Forks
- 3.8k
- Avg merge
- 2d 58m
- Merged PRs (30d)
- 233
Description
### Description
The latest version (1.1.0) of parquet includes a shaded jackson-databind:2.9.10, which has security vulnerabilities with CVSS 7 or higher. When a newer version of parquet is available with an updated version of jackson (2.9.10+), update the version used by parquet-extensions.
### Motivation
Address security vulnerabilities.
Contributor guide
Research direction
Start by locating the dependency declaration for parquet-extensions and checking which newer parquet release provides an updated shaded Jackson version. Done means parquet-extensions uses a release without the reported vulnerable Jackson dependency; verify with the repository's dependency or build checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100