From 6ad763b54ff5a2c9beed9de8d830e10fcc83334a Mon Sep 17 00:00:00 2001
From: Anoopam Sharma <anoopam.sharma@ericsson.com>
Date: Thu, 13 Aug 2026 10:20:50 +0530
Subject: [PATCH] [SPARK-58755][BUILD] Upgrade 6 third-party dependencies to
 fix 29 security vulnerabilities

Upgrades:
- libthrift: 0.16.0 -> 0.24.0 (18 CVEs)
- Jackson (fasterxml): 2.22.0 -> 2.22.1 (4 CVEs)
- Log4j: 2.26.0 -> 2.26.1 (1 CVE)
- Janino: 3.1.9 -> 3.1.12 (1 CVE)
- Apache Ivy: 2.5.3 -> 2.6.0 (1 CVE)
- scalapb-runtime: 0.11.17 -> 0.11.20 (4 CVEs)

All upgrades are minor/patch versions maintaining backward compatibility.
Full distribution build passes with no compile errors.
No user-facing API changes.

Closes #XXXXX
---
 dev/deps/spark-deps-hadoop-3-hive-2.3 | 30 +++++++++++++--------------
 pom.xml                               | 10 ++++-----
 sql/connect/client/jvm/pom.xml        |  6 ++++++
 3 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/dev/deps/spark-deps-hadoop-3-hive-2.3 b/dev/deps/spark-deps-hadoop-3-hive-2.3
index 943a82d0c0e4b..c2c8b962d940f 100644
--- a/dev/deps/spark-deps-hadoop-3-hive-2.3
+++ b/dev/deps/spark-deps-hadoop-3-hive-2.3
@@ -44,7 +44,7 @@ chill_2.13/0.10.0//chill_2.13-0.10.0.jar
 commons-cli/1.11.0//commons-cli-1.11.0.jar
 commons-codec/1.22.0//commons-codec-1.22.0.jar
 commons-collections4/4.5.0//commons-collections4-4.5.0.jar
-commons-compiler/3.1.9//commons-compiler-3.1.9.jar
+commons-compiler/3.1.12//commons-compiler-3.1.12.jar
 commons-compress/1.28.0//commons-compress-1.28.0.jar
 commons-crypto/1.1.0//commons-crypto-1.1.0.jar
 commons-dbcp/1.4//commons-dbcp-1.4.jar
@@ -104,14 +104,14 @@ httpcore/4.4.16//httpcore-4.4.16.jar
 icu4j/78.3//icu4j-78.3.jar
 ini4j/0.5.4//ini4j-0.5.4.jar
 istack-commons-runtime/4.1.2//istack-commons-runtime-4.1.2.jar
-ivy/2.5.3//ivy-2.5.3.jar
+ivy/2.6.0//ivy-2.6.0.jar
 jackson-annotations/2.22//jackson-annotations-2.22.jar
-jackson-core/2.22.0//jackson-core-2.22.0.jar
-jackson-databind/2.22.0//jackson-databind-2.22.0.jar
-jackson-dataformat-cbor/2.22.0//jackson-dataformat-cbor-2.22.0.jar
-jackson-dataformat-yaml/2.22.0//jackson-dataformat-yaml-2.22.0.jar
-jackson-datatype-jsr310/2.22.0//jackson-datatype-jsr310-2.22.0.jar
-jackson-module-scala_2.13/2.22.0//jackson-module-scala_2.13-2.22.0.jar
+jackson-core/2.22.1//jackson-core-2.22.1.jar
+jackson-databind/2.22.1//jackson-databind-2.22.1.jar
+jackson-dataformat-cbor/2.22.1//jackson-dataformat-cbor-2.22.1.jar
+jackson-dataformat-yaml/2.22.1//jackson-dataformat-yaml-2.22.1.jar
+jackson-datatype-jsr310/2.22.1//jackson-datatype-jsr310-2.22.1.jar
+jackson-module-scala_2.13/2.22.1//jackson-module-scala_2.13-2.22.1.jar
 jakarta.activation-api/2.1.4//jakarta.activation-api-2.1.4.jar
 jakarta.annotation-api/2.1.1//jakarta.annotation-api-2.1.1.jar
 jakarta.inject-api/2.0.1//jakarta.inject-api-2.0.1.jar
@@ -119,7 +119,7 @@ jakarta.servlet-api/6.0.0//jakarta.servlet-api-6.0.0.jar
 jakarta.validation-api/3.0.2//jakarta.validation-api-3.0.2.jar
 jakarta.ws.rs-api/3.1.0//jakarta.ws.rs-api-3.1.0.jar
 jakarta.xml.bind-api/4.0.5//jakarta.xml.bind-api-4.0.5.jar
-janino/3.1.9//janino-3.1.9.jar
+janino/3.1.12//janino-3.1.12.jar
 java-diff-utils/4.16//java-diff-utils-4.16.jar
 java-trace-api/0.2.11-beta//java-trace-api-0.2.11-beta.jar
 javassist/3.30.2-GA//javassist-3.30.2-GA.jar
@@ -184,12 +184,12 @@ kubernetes-model-storageclass/7.8.0//kubernetes-model-storageclass-7.8.0.jar
 lapack/3.2.0//lapack-3.2.0.jar
 leveldbjni-all/1.8//leveldbjni-all-1.8.jar
 libfb303/0.9.3//libfb303-0.9.3.jar
-libthrift/0.16.0//libthrift-0.16.0.jar
-log4j-1.2-api/2.26.0//log4j-1.2-api-2.26.0.jar
-log4j-api/2.26.0//log4j-api-2.26.0.jar
-log4j-core/2.26.0//log4j-core-2.26.0.jar
-log4j-layout-template-json/2.26.0//log4j-layout-template-json-2.26.0.jar
-log4j-slf4j2-impl/2.26.0//log4j-slf4j2-impl-2.26.0.jar
+libthrift/0.24.0//libthrift-0.24.0.jar
+log4j-1.2-api/2.26.1//log4j-1.2-api-2.26.1.jar
+log4j-api/2.26.1//log4j-api-2.26.1.jar
+log4j-core/2.26.1//log4j-core-2.26.1.jar
+log4j-layout-template-json/2.26.1//log4j-layout-template-json-2.26.1.jar
+log4j-slf4j2-impl/2.26.1//log4j-slf4j2-impl-2.26.1.jar
 lz4-java/1.11.2//lz4-java-1.11.2.jar
 metrics-core/4.2.37//metrics-core-4.2.37.jar
 metrics-graphite/4.2.37//metrics-graphite-4.2.37.jar
diff --git a/pom.xml b/pom.xml
index 12f48a4832ca0..90cf73a0d2322 100644
--- a/pom.xml
+++ b/pom.xml
@@ -129,7 +129,7 @@
     <sbt.project.name>spark</sbt.project.name>
     <asm.version>9.10.1</asm.version>
     <slf4j.version>2.0.17</slf4j.version>
-    <log4j.version>2.26.0</log4j.version>
+    <log4j.version>2.26.1</log4j.version>
     <!-- make sure to update IsolatedClientLoader whenever this version is changed -->
     <hadoop.version>3.5.0</hadoop.version>
     <!-- SPARK-41247: When updating `protobuf.version`, also need to update `protoVersion` in `SparkBuild.scala` -->
@@ -154,7 +154,7 @@
     <javaxservlet.version>4.0.1</javaxservlet.version>
     <chill.version>0.10.0</chill.version>
     <kryo.version>4.0.3</kryo.version>
-    <ivy.version>2.5.3</ivy.version>
+    <ivy.version>2.6.0</ivy.version>
     <oro.version>2.0.8</oro.version>
     <!--
     If you change codahale.metrics.version, you also need to change
@@ -185,7 +185,7 @@
     <scalafmt.validateOnly>true</scalafmt.validateOnly>
     <scalafmt.changedOnly>true</scalafmt.changedOnly>
     <!-- Should be consistent with SparkBuild.scala and docs -->
-    <fasterxml.jackson.version>2.22.0</fasterxml.jackson.version>
+    <fasterxml.jackson.version>2.22.1</fasterxml.jackson.version>
     <ws.xmlschema.version>2.3.1</ws.xmlschema.version>
     <snappy.version>1.1.10.8</snappy.version>
     <netlib.ludovic.dev.version>3.2.0</netlib.ludovic.dev.version>
@@ -202,12 +202,12 @@
     <guava.version>33.6.0-jre</guava.version>
     <guava.failureaccess.version>1.0.3</guava.failureaccess.version>
     <gson.version>2.14.0</gson.version>
-    <janino.version>3.1.9</janino.version>
+    <janino.version>3.1.12</janino.version>
     <jersey.version>3.1.11</jersey.version>
     <joda.version>2.14.3</joda.version>
     <jsr305.version>3.0.0</jsr305.version>
     <jaxb.version>2.2.11</jaxb.version>
-    <libthrift.version>0.16.0</libthrift.version>
+    <libthrift.version>0.24.0</libthrift.version>
     <antlr4.version>4.13.1</antlr4.version>
     <jpam.version>1.1</jpam.version>
     <selenium.version>4.32.0</selenium.version>
diff --git a/sql/connect/client/jvm/pom.xml b/sql/connect/client/jvm/pom.xml
index fe25d6ebce3cc..d20013327aac8 100644
--- a/sql/connect/client/jvm/pom.xml
+++ b/sql/connect/client/jvm/pom.xml
@@ -124,6 +124,12 @@
       </exclusions>
       <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>com.thesamet.scalapb</groupId>
+      <artifactId>scalapb-runtime_${scala.binary.version}</artifactId>
+      <version>0.11.20</version>
+      <scope>provided</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.spark</groupId>
       <artifactId>spark-tags_${scala.binary.version}</artifactId>