Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[SPARK-45590][BUILD][3.5] Upgrade okio to 1.17.6 from 1.15.0
Backport #47758 to 3.5 ### What changes were proposed in this pull request? This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. ### Why are the changes needed? Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 #5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 #5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #47769 from roczei/roczei/SPARK-45590-branch-3.5. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org>
- Loading branch information