Skip to content

1.11.1

  • 1.11.1
  • 84eeea5

  • Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    GPG key ID: B5690EEEBB952194
    Verified
    Learn about vigilant mode

  • Choose a tag to compare

    View all tags
1.11.1: [b/579421681] Pin Apache Kerby to 2.1.2 (CVE-2026-57914) (#1196)
  • 1.11.1
  • 84eeea5

  • Choose a tag to compare

    View all tags

  • Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature.
    GPG key ID: B5690EEEBB952194
    Verified
    Learn about vigilant mode
@kaxuna kaxuna tagged this 06 Nov 15:12 
hadoop-auth pulls org.apache.kerby:* 2.0.3, which is affected by
CVE-2026-57914 (GHSA-x6vc-x4v4-hjhr). Align the whole group to 2.1.2
(targets Java 8) with a resolutionStrategy rule in dumper/app and
lib-ext-hive-metastore instead of seven catalog pins; Kerby ships no BOM.

Lockfiles regenerated with scoped --update-locks 'org.apache.kerby:*';
no other coordinate changes.

Follow-up to #1195. Jetty 9.4.60+/9.4.63 referenced by the remaining
Jetty advisories are not public releases (9.4.58 is the last), so Jetty
is handled separately via exclusion from hadoop-common.

Bug: b/579421681
Assets 2
Loading