flink
flink copied to clipboard
[FLINK-36537] Bump snappy-java from 1.1.10.4 to 1.1.10.7
What is the purpose of the change
Bump snappy-java from 1.1.10.4 to 1.1.10.7
Brief change log
The current version has vulnerability in the dependant package, bumping it to the latest version will remediate.
Vulnerabilities from dependencies: CVE-2024-23454 CVE-2022-26612
Package details: https://mvnrepository.com/artifact/org.xerial.snappy/snappy-java/1.1.10.7
Verifying this change
This change is a trivial rework / code cleanup without any test coverage.
Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): yes
- The public API, i.e., is any changed class annotated with
@Public(Evolving): no - The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
CI report:
- bdf08116b840aa00a8efb1c0fa9ac04a6addc105 Azure: SUCCESS
Bot commands
The @flinkbot bot supports the following commands:-
@flinkbot run azurere-run the last Azure build
@ferenc-csaky can you review this PR 😃