apache / apache/druid

Update parquet version in parquet-extensions to address security vulnerabilities

Open
#9,498 0 comments 0 reactions 0 assignees View on GitHub
Area - Dependencies Security
Dominant language
Java
Stars
14.1k
Forks
3.8k
Avg merge
2d 58m
Merged PRs (30d)
233

Description

### Description

The latest version (1.1.0) of parquet includes a shaded jackson-databind:2.9.10, which has security vulnerabilities with CVSS 7 or higher. When a newer version of parquet is available with an updated version of jackson (2.9.10+), update the version used by parquet-extensions.

### Motivation

Address security vulnerabilities.

Contributor guide

Open the contributing guide

Research direction

Start by locating the dependency declaration for parquet-extensions and checking which newer parquet release provides an updated shaded Jackson version. Done means parquet-extensions uses a release without the reported vulnerable Jackson dependency; verify with the repository's dependency or build checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.