Upgrade avro & its dependencies to resolve CVEs #23943
Open
+16
−11
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Upgrade avro & its dependencies to resolve CVE-2024-47561 If applied, this will: Upgrade avro to version 1.11.4 Upgrade commons-compress to version 1.26.2 Upgrade commons-codec to version 1.17.0 Upgrade commons-lang3 to version 3.14.0 Upgrade commons-io to version 2.16.1
|
Thanks for the release note entry! Nit to use present tense instead of past tense, as shown in the Order of changes. |
|
@konjac-h @rschlussel could you please test this commit to make sure it works with Meta's internal module? Thank you |
|
@infvg the current PR is still failing the module. I will see what I can do either taking over the change or have a duplicate dummy module in presto repo for you to test it. Let me get back to you later this week |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Upgraded avro to version 1.11.4 to resolve CVE-2024-47561
Upgraded commons-compress to version 1.26.2
Upgraded commons-codec to version 1.17.0
Upgraded commons-lang3 to version 3.14.0
Upgraded commons-io to version 2.16.1
This also resolves the issue faced that caused the previous revert:
#23931
Motivation and Context
This upgrade was created to deal with CVEs found in lower versions
Impact
None
Release Notes