Skip to content

[HUDI-9273] Upgrade Parquet to 1.15.1 to address CVE-2025-30065 #13315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
adith-os wants to merge 2 commits into from
Closed

[HUDI-9273] Upgrade Parquet to 1.15.1 to address CVE-2025-30065 #13315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d592f20
Update Parquet versions for spark 3, 3.3,3.4, 3.5 profiles
adith-os May 18, 2025
a74df3f
shade parquet dependencies due to failures
adith-os May 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packaging/hudi-spark-bundle/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,11 @@
<include>com.github.davidmoten:hilbert-curve</include>
<include>com.github.ben-manes.caffeine:caffeine</include>
<include>org.apache.parquet:parquet-avro</include>
<include>org.apache.parquet:parquet-common</include>
<include>org.apache.parquet:parquet-hadoop</include>
<include>org.apache.parquet:parquet-column</include>
<include>org.apache.parquet:parquet-format-structures</include>
<include>org.apache.parquet:parquet-encoding</include>
<include>com.twitter:chill-protobuf</include>

<include>io.dropwizard.metrics:metrics-core</include>
Expand Down
8 changes: 4 additions & 4 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2431,7 +2431,7 @@
hudi-hadoop-mr, for ex). Since these Hudi modules might be used from w/in the execution engine(s)
bringing these file-formats as dependencies as well, we need to make sure that versions are
synchronized to avoid classpath ambiguity -->
<parquet.version>1.13.1</parquet.version>
<parquet.version>1.15.1</parquet.version>
<orc.spark.version>1.9.1</orc.spark.version>
<avro.version>1.11.4</avro.version>
<antlr.version>4.9.3</antlr.version>
Expand Down Expand Up @@ -2489,7 +2489,7 @@
hudi-hadoop-mr, for ex). Since these Hudi modules might be used from w/in the execution engine(s)
bringing these file-formats as dependencies as well, we need to make sure that versions are
synchronized to avoid classpath ambiguity -->
<parquet.version>1.12.2</parquet.version>
<parquet.version>1.15.1</parquet.version>
Copy link
Contributor

@yihua yihua May 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately this cannot be changed and the parquet version has to be aligned with What Spark uses in each Spark version. Otherwise there can be compatibility issues.

Copy link
Contributor Author

@adith-os adith-os May 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay. Thank you for the review!

<orc.spark.version>1.7.8</orc.spark.version>
<avro.version>1.11.4</avro.version>
<antlr.version>4.8</antlr.version>
Expand Down Expand Up @@ -2529,7 +2529,7 @@
hudi-hadoop-mr, for ex). Since these Hudi modules might be used from w/in the execution engine(s)
bringing these file-formats as dependencies as well, we need to make sure that versions are
synchronized to avoid classpath ambiguity -->
<parquet.version>1.12.3</parquet.version>
<parquet.version>1.15.1</parquet.version>
<orc.spark.version>1.8.3</orc.spark.version>
<avro.version>1.11.4</avro.version>
<antlr.version>4.9.3</antlr.version>
Expand Down Expand Up @@ -2579,7 +2579,7 @@
hudi-hadoop-mr, for ex). Since these Hudi modules might be used from w/in the execution engine(s)
bringing these file-formats as dependencies as well, we need to make sure that versions are
synchronized to avoid classpath ambiguity -->
<parquet.version>1.13.1</parquet.version>
<parquet.version>1.15.1</parquet.version>
Copy link
Contributor

@danny0405 danny0405 May 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is the version backward compatible?

Copy link
Contributor Author

@adith-os adith-os May 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't figure out or find any mention of backward compatibility for this version with older versions. However, I noticed that adding this version does cause failures because now it is dependent on other parquet packages

Copy link
Contributor

@danny0405 danny0405 May 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, but still, thanks for the contribution, is the fix a blocker for you?

Copy link
Contributor Author

@adith-os adith-os May 20, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No problem. It is not a blocker for me, I could fix errors like the below one by shading the required parquet packages for spark-bundle for my usecase. I wanted to contribute the same change but I see the same error in the tests which is a bit confusing 😅

recent failure: Lost task 0.3 in stage 12.0 (TID 26) (172.30.95.61 executor 1): java.lang.NoClassDefFoundError: org.apache.parquet.conf.HadoopParquetConfiguration
	at org.apache.parquet.avro.AvroSchemaConverter.<init>(AvroSchemaConverter.java:111)

<orc.spark.version>1.9.1</orc.spark.version>
<avro.version>1.11.4</avro.version>
<antlr.version>4.9.3</antlr.version>
Expand Down
Loading