Skip to content

minor: upgrade pac4j and log4j and rhino #19388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cecemei merged 4 commits into from
Apr 29, 2026
+27 −11
Merged

minor: upgrade pac4j and log4j and rhino #19388

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9b7f3e9
upgrade
cecemei Apr 28, 2026
f8e819b
upgrade-rhino
cecemei Apr 28, 2026
8e9411e
hadoop
cecemei Apr 28, 2026
61778c6
nimbus.jose.jwt.version
cecemei Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions extensions-core/druid-pac4j/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,11 +34,11 @@
</parent>

<properties>
<pac4j.version>5.7.3</pac4j.version>
<pac4j.version>5.7.10</pac4j.version>

<!-- Following must be updated along with any updates to pac4j version. One can find the compatible version of nimbus libraries in org.pac4j:pac4j-oidc dependencies-->
<nimbus.lang.tag.version>1.7</nimbus.lang.tag.version>
<nimbus.jose.jwt.version>9.37.2</nimbus.jose.jwt.version>
<nimbus.jose.jwt.version>9.37.3</nimbus.jose.jwt.version>
<oauth2.oidc.sdk.version>10.8</oauth2.oidc.sdk.version>
</properties>

Expand Down
12 changes: 6 additions & 6 deletions licenses.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -877,7 +877,7 @@ name: pac4j-oidc java security library
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 5.7.3
version: 5.7.10
libraries:
- org.pac4j: pac4j-oidc

Expand All @@ -887,7 +887,7 @@ name: pac4j-core java security library
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 5.7.3
version: 5.7.10
libraries:
- org.pac4j: pac4j-core

Expand All @@ -897,7 +897,7 @@ name: pac4j-javaee java security library
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 5.7.3
version: 5.7.10
libraries:
- org.pac4j: pac4j-javaee

Expand All @@ -918,7 +918,7 @@ name: com.nimbusds nimbus-jose-jwt
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 9.37.2
version: 9.37.3
libraries:
- com.nimbusds: nimbus-jose-jwt

Expand Down Expand Up @@ -2000,7 +2000,7 @@ name: Apache Log4j
license_category: binary
module: java-core
license_name: Apache License version 2.0
version: 2.25.3
version: 2.25.4
libraries:
- org.apache.logging.log4j: log4j-1.2-api
- org.apache.logging.log4j: log4j-api
Expand Down Expand Up @@ -4042,7 +4042,7 @@ name: Rhino
license_category: binary
module: java-core
license_name: Mozilla Public License Version 2.0
version: 1.8.0
version: 1.8.1
copyright: Mozilla and individual contributors.
license_file_path: licenses/bin/rhino.MPL2
libraries:
Expand Down
16 changes: 16 additions & 0 deletions owasp-dependency-check-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,14 @@
<cve>CVE-2025-5115</cve> <!-- netty issue in shaded hadoop -->
</suppress>

<suppress>
<!-- from extensions using hadoop-client-runtime 3.5.0, these dependencies are shaded in the jar -->
<notes><![CDATA[
file name: hadoop-client-runtime-3.5.0.jar
]]></notes>
<cve>CVE-2026-5795</cve> <!-- Jetty 9.4.58 JASPI ThreadLocal privilege escalation in shaded hadoop. Not exploitable in Druid's Hadoop client usage (file operations only, no JASPI auth). Requires Hadoop to update to Jetty 9.4.59+ -->
Copy link
Copy Markdown
Member

@FrankChen021 FrankChen021 Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Scope the Hadoop CVE suppression

This suppression has only a CVE selector, so dependency-check will suppress CVE-2026-5795 for every dependency in the scan, not just the shaded Jetty copy in hadoop-client-runtime-3.5.0. That can hide a real vulnerable Jetty artifact if one is introduced elsewhere. Add a dependency selector such as a packageUrl/filePath regex for org.apache.hadoop:hadoop-client-runtime:3.5.0 before suppressing this CVE.

</suppress>

<!-- those are false positives, no other tools report any of those CVEs in the hadoop package -->
<suppress>
<notes><![CDATA[
Expand Down Expand Up @@ -752,4 +760,12 @@
]]></notes>
<vulnerabilityName>CVE-2024-11407</vulnerabilityName> <!-- This CVE is a false positive for java. The CVE is related to their cpp library, not java -->
</suppress>

<suppress>
<notes><![CDATA[
file name: grpc-*.jar (all grpc-java artifacts, any version)
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
</suppressions>
6 changes: 3 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@
<jersey.version>1.19.4</jersey.version>
<jackson.version>2.20.2</jackson.version>
<codehaus.jackson.version>1.9.13</codehaus.jackson.version>
<log4j.version>2.25.3</log4j.version>
<log4j.version>2.25.4</log4j.version>
<mysql.version>8.2.0</mysql.version>
<mariadb.version>2.7.3</mariadb.version>
<netty3.version>3.10.6.Final</netty3.version>
Expand Down Expand Up @@ -683,12 +683,12 @@
<dependency>
<groupId>org.mozilla</groupId>
<artifactId>rhino</artifactId>
<version>1.8.0</version>
<version>1.8.1</version>
</dependency>
<dependency>
<groupId>org.mozilla</groupId>
<artifactId>rhino-engine</artifactId>
<version>1.8.0</version>
<version>1.8.1</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
Expand Down
Loading