chrislu e2e89b52b7 security: add dependency overrides for vulnerable transitive deps ...

- Add commons-beanutils 1.11.0 (fixes CVE in 1.9.4)
- Add protobuf-java 3.25.5 (compatible with Spark/Hadoop ecosystem)
- Add nimbus-jose-jwt 9.37.2 (minimum secure version)
- Add snappy-java 1.1.10.4 (fixes compression vulnerabilities)
- Add dnsjava 3.6.0 (fixes DNS security issues)

All dependencies are pulled transitively from Hadoop/Spark:
- commons-beanutils: hadoop-common
- protobuf-java: hadoop-common
- nimbus-jose-jwt: hadoop-auth
- snappy-java: spark-core
- dnsjava: hadoop-common

Verified with mvn dependency:tree that overrides are applied correctly.

2025-11-22 22:06:29 -08:00

..

spark

security: add dependency overrides for vulnerable transitive deps

2025-11-22 22:06:29 -08:00