diff --git a/src/test/py/bazel/bazel_external_repository_test.py b/src/test/py/bazel/bazel_external_repository_test.py
index c97ba3fcf7c651..4d1dc0dbe5606c 100644
--- a/src/test/py/bazel/bazel_external_repository_test.py
+++ b/src/test/py/bazel/bazel_external_repository_test.py
@@ -50,8 +50,10 @@ def StopHttpServer(self):
   def setUp(self):
     test_base.TestBase.setUp(self)
     for f in [
-        'six-1.10.0.tar.gz', 'archive_with_symlink.zip',
-        'archive_with_symlink.tar.gz'
+        'six-1.10.0.tar.gz',
+        'archive_with_symlink.zip',
+        'archive_with_symlink.tar.gz',
+        'sparse_archive.tar',
     ]:
       self.CopyFile(self.Rlocation('io_bazel/src/test/py/bazel/testdata/'
                                    'bazel_external_repository_test/' + f), f)
@@ -167,6 +169,63 @@ def testNewHttpTarArchiveWithSymlinks(self):
     ])
     self.assertEqual(exit_code, 0, os.linesep.join(stderr))
 
+  def testNewHttpTarWithSparseFile(self):
+    # Test extraction of tar archives containing sparse files.
+    # The archive under test was produced using GNU tar on Linux:
+    #   truncate -s 1M sparse_file
+    #   tar -c --sparse --format posix -f sparse_archive.tar sparse_file
+
+    ip, port = self._http_server.server_address
+    rule_definition = [
+        'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")',
+        'http_archive(',
+        '    name = "sparse_archive",',
+        '    urls = ["http://%s:%s/sparse_archive.tar"],' % (ip, port),
+        '    build_file = "@//:sparse_archive.BUILD",',
+        '    sha256 = ',
+        (
+            '  "a1a2b2ce4acd51a8cc1ab80adce6f134ac73e885219911a960a42000e312bb65",'
+            ')'
+        ),
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile('WORKSPACE', rule_definition)
+    self.ScratchFile(
+        'sparse_archive.BUILD',
+        [
+            'exports_files(["sparse_file"])',
+        ],
+    )
+    self.ScratchFile(
+        'test.py',
+        [
+            'import sys',
+            'from tools.python.runfiles import runfiles',
+            'path = runfiles.Create().Rlocation(sys.argv[1])',
+            'if open(path, "rb").read() != b"\\0"*1024*1024:',
+            '  sys.exit(1)',
+        ],
+    )
+    self.ScratchFile(
+        'BUILD',
+        [
+            'py_test(',
+            '    name = "test",',
+            '    srcs = ["test.py"],',
+            (
+                '    args = ["$(rlocationpath @sparse_archive//:sparse_file)"],'
+                '    data = ['
+            ),
+            '        "@sparse_archive//:sparse_file",',
+            '        "@bazel_tools//tools/python/runfiles",',
+            '    ],)',
+        ],
+    )
+    self.RunBazel([
+        'test',
+        '//:test',
+    ])
+
   def _CreatePyWritingStarlarkRule(self, print_string):
     self.ScratchFile('repo/foo.bzl', [
         'def _impl(ctx):',
diff --git a/src/test/py/bazel/testdata/bazel_external_repository_test/sparse_archive.tar b/src/test/py/bazel/testdata/bazel_external_repository_test/sparse_archive.tar
new file mode 100644
index 00000000000000..693e027a62bb43
Binary files /dev/null and b/src/test/py/bazel/testdata/bazel_external_repository_test/sparse_archive.tar differ
diff --git a/third_party/BUILD b/third_party/BUILD
index 8ea4d22cd08064..e19ad014e171bb 100644
--- a/third_party/BUILD
+++ b/third_party/BUILD
@@ -140,7 +140,7 @@ distrib_java_import(
 distrib_java_import(
     name = "apache_commons_compress",
     enable_distributions = ["debian"],
-    jars = ["apache_commons_compress/apache-commons-compress-1.19.jar"],
+    jars = ["apache_commons_compress/apache-commons-compress-1.20.jar"],
 )
 
 distrib_java_import(
diff --git a/third_party/apache_commons_compress/apache-commons-compress-1.19.jar b/third_party/apache_commons_compress/apache-commons-compress-1.19.jar
deleted file mode 100644
index 5c9f52a2903d82..00000000000000
Binary files a/third_party/apache_commons_compress/apache-commons-compress-1.19.jar and /dev/null differ
diff --git a/third_party/apache_commons_compress/apache-commons-compress-1.20.jar b/third_party/apache_commons_compress/apache-commons-compress-1.20.jar
new file mode 100644
index 00000000000000..17c1c7b457d801
Binary files /dev/null and b/third_party/apache_commons_compress/apache-commons-compress-1.20.jar differ