Skip to content

Update Apache Thrift to 0.24.0 - #1682

Merged
vikrantpuppala merged 1 commit into
mainfrom
vp/fix-security-scan-20260909
Sep 9, 2026
Merged

Update Apache Thrift to 0.24.0#1682
vikrantpuppala merged 1 commit into
mainfrom
vp/fix-security-scan-20260909

Conversation

@vikrantpuppala

Copy link
Copy Markdown
Collaborator

Description

  • Upgrade bundled Apache Thrift from 0.23.0 to 0.24.0.
  • Address CVE-2026-43871 reported by the repository security scan.
  • Document the dependency update in the next release changelog.

Testing

  • mvn package -DskipTests -Ddependency-check.skip=true
  • mvn -pl jdbc-core dependency:tree -Dincludes=org.apache.thrift:libthrift -DskipTests -Ddependency-check.skip=true — resolves 0.24.0
  • Broad unit-test run: 3,638 tests passed. One JDK no-open-only allocator test was selected under the generic --add-opens JVM configuration; its documented filtered invocation passes and is unrelated to Thrift.
  • git diff --check

Telemetry Errors

  • Not applicable — this PR does not add or change a telemetry-visible error.
  • Applicable — the error uses DatabricksDriverErrorCode where appropriate, and any new code is uniquely numbered and tested.
  • Applicable — its driver/server/user classification is linked, or maintainer help is requested because the author cannot access the classification.

Additional Notes to the Reviewer

No runtime code changes are included.

Upgrade the bundled libthrift dependency to address CVE-2026-43871 and document the change in the next release notes.

Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>

@peco-review-bot peco-review-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No issues identified by the review bot.

@vikrantpuppala
vikrantpuppala added this pull request to the merge queue Sep 9, 2026
Merged via the queue into main with commit 162c3d9 Sep 9, 2026
36 of 49 checks passed
@vikrantpuppala
vikrantpuppala deleted the vp/fix-security-scan-20260909 branch September 9, 2026 06:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants