chrislu 7b548be48e security: add dependencyManagement to fix vulnerable transitives ...

- Pin Jackson to 2.15.3 (fixes multiple CVEs in older versions)
- Pin Netty to 4.1.100.Final (fixes CVEs in transport/codec)
- Pin Apache Avro to 1.11.4 (fixes deserialization CVEs)
- Pin Apache ZooKeeper to 3.9.1 (fixes authentication bypass)
- Pin commons-compress to 1.26.0 (fixes zip slip vulnerabilities)
- Pin commons-io to 2.15.1 (fixes path traversal)
- Pin Guava to 32.1.3-jre (fixes temp directory vulnerabilities)
- Pin SnakeYAML to 2.2 (fixes arbitrary code execution)
- Pin Jetty to 9.4.53 (fixes multiple HTTP vulnerabilities)
- Overrides vulnerable versions from Spark/Hadoop transitives

2025-11-22 14:05:24 -08:00

..

spark

security: add dependencyManagement to fix vulnerable transitives

2025-11-22 14:05:24 -08:00