Fix aircompressor dep (#226)

exasol · Jun 4, 2024 · c83d655 · c83d655
1 parent 8503c83
commit c83d655
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 1 deletion.
diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md
diff --git a/doc/changes/changes_2.1.8.md b/doc/changes/changes_2.1.8.md
@@ -0,0 +1,24 @@
+# Spark Connector 2.1.8, released 2024-06-04
+
+Code name: Fix CVEs
+
+## Summary
+Fixed CVE-2024-36114 in io.airlift:aircompressor (dependency of spark-sql).
+
+## Features
+
+* #225: Fix CVE-2024-36114 in io.airlift:aircompressor:jar:0.21:provided
+
+## Dependency Updates
+
+### Spark Exasol Connector With JDBC
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:spark-connector-common-java:2.0.1` to `2.0.5`
+
+### Spark Exasol Connector With S3
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:spark-connector-common-java:2.0.1` to `2.0.5`
diff --git a/parent-pom/pom.xml b/parent-pom/pom.xml
@@ -15,7 +15,7 @@
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
     <properties>
-        <revision>2.1.7</revision>
+        <revision>2.1.8</revision>
         <java.version>8</java.version>
         <log4j.version>2.20.0</log4j.version>
         <junit.version>5.10.0</junit.version>
@@ -200,6 +200,10 @@
                         <groupId>org.xerial.snappy</groupId>
                         <artifactId>snappy-java</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>io.airlift</groupId>
+                        <artifactId>aircompressor</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>
@@ -238,6 +242,13 @@
                 <artifactId>nimbus-jose-jwt</artifactId>
                 <version>9.37.3</version>
             </dependency>
+            <dependency>
+                <!-- Fix CVE-2024-36114 in transitive dependency of spark-sql -->
+                <groupId>io.airlift</groupId>
+                <artifactId>aircompressor</artifactId>
+                <version>0.27</version>
+                <scope>provided</scope>
+            </dependency>
             <dependency>
                 <groupId>org.apache.hadoop</groupId>
                 <artifactId>hadoop-client</artifactId>