From 0693ec8200e9cdd030cd97629f04cd339d9bcdc3 Mon Sep 17 00:00:00 2001 From: anupamme Date: Wed, 5 Aug 2026 02:18:22 +0000 Subject: [PATCH 1/7] fix: CVE-2021-0341 security vulnerability Automated dependency upgrade by OrbisAI Security --- hadoop-cloud/pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hadoop-cloud/pom.xml b/hadoop-cloud/pom.xml index e87fbfae61a6a..31e8151498a14 100644 --- a/hadoop-cloud/pom.xml +++ b/hadoop-cloud/pom.xml @@ -34,8 +34,8 @@ hadoop-cloud - 3.12.12 - 1.17.6 + 4.9.2 + 2.10.0 2.3.0.Final From 9e69623c5e5c167b0f9201db427940efe3ecf5f9 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Wed, 5 Aug 2026 18:18:40 +0530 Subject: [PATCH 2/7] [SPARK-57794][BUILD] Upgrade okhttp to 4.12.0 and okio to 3.9.1 for CVE-2021-0341 - hadoop-cloud/pom.xml: okhttp 4.9.2 -> 4.12.0, okio 2.10.0 -> 3.9.1 - LICENSE-binary: add kotlin-stdlib, kotlin-stdlib-common, kotlin-stdlib-jdk8 (new Apache-2.0 transitive dependencies introduced by okhttp 4.x) Co-Authored-By: Claude Opus 4.6 --- LICENSE-binary | 3 +++ hadoop-cloud/pom.xml | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/LICENSE-binary b/LICENSE-binary index 9d2a6a1acc6a5..6a98298c83ccc 100644 --- a/LICENSE-binary +++ b/LICENSE-binary @@ -388,6 +388,9 @@ org.glassfish.jersey.core:jersey-common org.glassfish.jersey.core:jersey-server org.glassfish.jersey.inject:jersey-hk2 org.javassist:javassist +org.jetbrains.kotlin:kotlin-stdlib +org.jetbrains.kotlin:kotlin-stdlib-common +org.jetbrains.kotlin:kotlin-stdlib-jdk8 org.json4s:json4s-ast_2.13 org.json4s:json4s-core_2.13 org.json4s:json4s-jackson-core_2.13 diff --git a/hadoop-cloud/pom.xml b/hadoop-cloud/pom.xml index 31e8151498a14..6915112f0813c 100644 --- a/hadoop-cloud/pom.xml +++ b/hadoop-cloud/pom.xml @@ -34,8 +34,8 @@ hadoop-cloud - 4.9.2 - 2.10.0 + 4.12.0 + 3.9.1 2.3.0.Final From 756832413fe30e5e042eec0e146bd5ebdcb47815 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Wed, 5 Aug 2026 18:26:29 +0530 Subject: [PATCH 3/7] [SPARK-57794][BUILD] Regenerate deps manifest for okhttp 4.12.0 / okio 3.9.1 Update dev/deps/spark-deps-hadoop-3-hive-2.3: - okhttp 3.12.12 -> 4.12.0 - okio 1.17.6 -> 3.9.1 (+ okio-jvm/3.9.1 for the Kotlin multiplatform split) - New transitive deps: annotations/13.0, kotlin-stdlib/1.9.25, kotlin-stdlib-common/1.9.25, kotlin-stdlib-jdk7/1.8.21, kotlin-stdlib-jdk8/1.8.21 Co-Authored-By: Claude Opus 4.6 --- dev/deps/spark-deps-hadoop-3-hive-2.3 | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3 index 17c7f3f2db378..c2f7a25e63439 100644 --- a/dev/deps/spark-deps-hadoop-3-hive-2.3 +++ b/dev/deps/spark-deps-hadoop-3-hive-2.3 @@ -12,6 +12,7 @@ aliyun-java-sdk-kms/2.11.0//aliyun-java-sdk-kms-2.11.0.jar aliyun-java-sdk-ram/3.1.0//aliyun-java-sdk-ram-3.1.0.jar aliyun-sdk-oss/3.18.1//aliyun-sdk-oss-3.18.1.jar analyticsaccelerator-s3/1.3.1//analyticsaccelerator-s3-1.3.1.jar +annotations/13.0//annotations-13.0.jar antlr-runtime/3.5.2//antlr-runtime-3.5.2.jar antlr4-runtime/4.13.1//antlr4-runtime-4.13.1.jar aopalliance-repackaged/3.0.6//aopalliance-repackaged-3.0.6.jar @@ -180,6 +181,10 @@ kubernetes-model-rbac/7.8.0//kubernetes-model-rbac-7.8.0.jar kubernetes-model-resource/7.8.0//kubernetes-model-resource-7.8.0.jar kubernetes-model-scheduling/7.8.0//kubernetes-model-scheduling-7.8.0.jar kubernetes-model-storageclass/7.8.0//kubernetes-model-storageclass-7.8.0.jar +kotlin-stdlib-common/1.9.25//kotlin-stdlib-common-1.9.25.jar +kotlin-stdlib-jdk7/1.8.21//kotlin-stdlib-jdk7-1.8.21.jar +kotlin-stdlib-jdk8/1.8.21//kotlin-stdlib-jdk8-1.8.21.jar +kotlin-stdlib/1.9.25//kotlin-stdlib-1.9.25.jar lapack/3.2.0//lapack-3.2.0.jar leveldbjni-all/1.8//leveldbjni-all-1.8.jar libfb303/0.9.3//libfb303-0.9.3.jar @@ -226,8 +231,9 @@ netty-transport-native-kqueue/4.2.16.Final/osx-x86_64/netty-transport-native-kqu netty-transport-native-unix-common/4.2.16.Final//netty-transport-native-unix-common-4.2.16.Final.jar netty-transport/4.2.16.Final//netty-transport-4.2.16.Final.jar objenesis/3.5//objenesis-3.5.jar -okhttp/3.12.12//okhttp-3.12.12.jar -okio/1.17.6//okio-1.17.6.jar +okhttp/4.12.0//okhttp-4.12.0.jar +okio-jvm/3.9.1//okio-jvm-3.9.1.jar +okio/3.9.1//okio-3.9.1.jar opencsv/2.3//opencsv-2.3.jar opentelemetry-api/1.49.0//opentelemetry-api-1.49.0.jar opentelemetry-context/1.49.0//opentelemetry-context-1.49.0.jar From 70e4f37bf197d37fc674deae3c5282af1b7408ac Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Wed, 5 Aug 2026 19:48:35 +0530 Subject: [PATCH 4/7] Trigger CI From 329b26f96c7f207d6a1e6aca02431d88accd2436 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Thu, 6 Aug 2026 06:38:42 +0530 Subject: [PATCH 5/7] [SPARK-57794][BUILD] Regenerate deps manifest for okhttp 4.12.0 / okio 3.9.1 Remove kotlin-stdlib entries from the manifest and LICENSE-binary: the Spark assembly excludes kotlin jars transitively, so they don't appear in Maven's dependency:build-classpath output. Co-Authored-By: Claude Opus 4.6 --- LICENSE-binary | 3 --- dev/deps/spark-deps-hadoop-3-hive-2.3 | 4 ---- 2 files changed, 7 deletions(-) diff --git a/LICENSE-binary b/LICENSE-binary index 6a98298c83ccc..9d2a6a1acc6a5 100644 --- a/LICENSE-binary +++ b/LICENSE-binary @@ -388,9 +388,6 @@ org.glassfish.jersey.core:jersey-common org.glassfish.jersey.core:jersey-server org.glassfish.jersey.inject:jersey-hk2 org.javassist:javassist -org.jetbrains.kotlin:kotlin-stdlib -org.jetbrains.kotlin:kotlin-stdlib-common -org.jetbrains.kotlin:kotlin-stdlib-jdk8 org.json4s:json4s-ast_2.13 org.json4s:json4s-core_2.13 org.json4s:json4s-jackson-core_2.13 diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3 index c2f7a25e63439..7514e84254e80 100644 --- a/dev/deps/spark-deps-hadoop-3-hive-2.3 +++ b/dev/deps/spark-deps-hadoop-3-hive-2.3 @@ -181,10 +181,6 @@ kubernetes-model-rbac/7.8.0//kubernetes-model-rbac-7.8.0.jar kubernetes-model-resource/7.8.0//kubernetes-model-resource-7.8.0.jar kubernetes-model-scheduling/7.8.0//kubernetes-model-scheduling-7.8.0.jar kubernetes-model-storageclass/7.8.0//kubernetes-model-storageclass-7.8.0.jar -kotlin-stdlib-common/1.9.25//kotlin-stdlib-common-1.9.25.jar -kotlin-stdlib-jdk7/1.8.21//kotlin-stdlib-jdk7-1.8.21.jar -kotlin-stdlib-jdk8/1.8.21//kotlin-stdlib-jdk8-1.8.21.jar -kotlin-stdlib/1.9.25//kotlin-stdlib-1.9.25.jar lapack/3.2.0//lapack-3.2.0.jar leveldbjni-all/1.8//leveldbjni-all-1.8.jar libfb303/0.9.3//libfb303-0.9.3.jar From 468d97631a47b280dd4efb56243b8c820622aa8b Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Thu, 6 Aug 2026 08:54:25 +0530 Subject: [PATCH 6/7] [SPARK-57794][BUILD] Remove hadoop-huaweicloud and its okhttp/okio dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hadoop-huaweicloud has received no meaningful updates since it landed in Hadoop in 2021. Spark has zero source code, tests, or documentation that reference it — it was a pure transitive dependency. Removing it eliminates CVE-2021-0341 (and its entire okhttp/okio/kotlin transitive tree) rather than trading one set of advisories for another. Co-Authored-By: Claude Opus 4.6 --- LICENSE-binary | 2 -- dev/deps/spark-deps-hadoop-3-hive-2.3 | 5 ----- hadoop-cloud/pom.xml | 30 --------------------------- pom.xml | 2 -- 4 files changed, 39 deletions(-) diff --git a/LICENSE-binary b/LICENSE-binary index 9d2a6a1acc6a5..d47843379eefd 100644 --- a/LICENSE-binary +++ b/LICENSE-binary @@ -220,8 +220,6 @@ com.google.flatbuffers:flatbuffers-java com.google.guava:guava com.jamesmurty.utils:java-xmlbuilder com.ning:compress-lzf -com.squareup.okhttp3:okhttp -com.squareup.okio:okio com.tdunning:json com.twitter:chill-java com.twitter:chill_2.13 diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3 index 7514e84254e80..c834c4f30c88e 100644 --- a/dev/deps/spark-deps-hadoop-3-hive-2.3 +++ b/dev/deps/spark-deps-hadoop-3-hive-2.3 @@ -12,7 +12,6 @@ aliyun-java-sdk-kms/2.11.0//aliyun-java-sdk-kms-2.11.0.jar aliyun-java-sdk-ram/3.1.0//aliyun-java-sdk-ram-3.1.0.jar aliyun-sdk-oss/3.18.1//aliyun-sdk-oss-3.18.1.jar analyticsaccelerator-s3/1.3.1//analyticsaccelerator-s3-1.3.1.jar -annotations/13.0//annotations-13.0.jar antlr-runtime/3.5.2//antlr-runtime-3.5.2.jar antlr4-runtime/4.13.1//antlr4-runtime-4.13.1.jar aopalliance-repackaged/3.0.6//aopalliance-repackaged-3.0.6.jar @@ -80,7 +79,6 @@ hadoop-client-api/3.5.0//hadoop-client-api-3.5.0.jar hadoop-client-runtime/3.5.0//hadoop-client-runtime-3.5.0.jar hadoop-cloud-storage/3.5.0//hadoop-cloud-storage-3.5.0.jar hadoop-gcp/3.5.0//hadoop-gcp-3.5.0.jar -hadoop-huaweicloud/3.5.0//hadoop-huaweicloud-3.5.0.jar hadoop-shaded-guava/1.5.0//hadoop-shaded-guava-1.5.0.jar hive-beeline/2.3.10//hive-beeline-2.3.10.jar hive-cli/2.3.10//hive-cli-2.3.10.jar @@ -227,9 +225,6 @@ netty-transport-native-kqueue/4.2.16.Final/osx-x86_64/netty-transport-native-kqu netty-transport-native-unix-common/4.2.16.Final//netty-transport-native-unix-common-4.2.16.Final.jar netty-transport/4.2.16.Final//netty-transport-4.2.16.Final.jar objenesis/3.5//objenesis-3.5.jar -okhttp/4.12.0//okhttp-4.12.0.jar -okio-jvm/3.9.1//okio-jvm-3.9.1.jar -okio/3.9.1//okio-3.9.1.jar opencsv/2.3//opencsv-2.3.jar opentelemetry-api/1.49.0//opentelemetry-api-1.49.0.jar opentelemetry-context/1.49.0//opentelemetry-context-1.49.0.jar diff --git a/hadoop-cloud/pom.xml b/hadoop-cloud/pom.xml index 6915112f0813c..1376b471dc976 100644 --- a/hadoop-cloud/pom.xml +++ b/hadoop-cloud/pom.xml @@ -34,8 +34,6 @@ hadoop-cloud - 4.12.0 - 3.9.1 2.3.0.Final @@ -158,12 +156,6 @@ ${hadoop.version} ${hadoop.deps.scope} - - org.apache.hadoop - hadoop-huaweicloud - ${hadoop.version} - ${huaweicloud.deps.scope} - compile compile - compile compile 2.8.1 compile @@ -3625,7 +3624,6 @@ hadoop-provided true - provided From 5aa20a16a029a2cf77965a0dd2a5672fea34c06a Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Thu, 6 Aug 2026 09:31:41 +0530 Subject: [PATCH 7/7] [SPARK-57794][BUILD] Keep hadoop-huaweicloud exclusion from hadoop-cloud-storage hadoop-cloud-storage transitively pulls in hadoop-huaweicloud, so the exclusion must remain even though the direct dependency was removed. Co-Authored-By: Claude Opus 4.6 --- hadoop-cloud/pom.xml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hadoop-cloud/pom.xml b/hadoop-cloud/pom.xml index 1376b471dc976..ae3b1f764ef55 100644 --- a/hadoop-cloud/pom.xml +++ b/hadoop-cloud/pom.xml @@ -189,6 +189,10 @@ org.apache.hadoop hadoop-tos + + org.apache.hadoop + hadoop-huaweicloud +