Repository navigation

release: Suppress CVEs that do not affect Druid - #20236

Merged

kfaraz merged 27 commits into

masterfrom

suppress_cves_38.0.0

Oct 15, 2026

Merged

release: Suppress CVEs that do not affect Druid#20236
kfaraz merged 27 commits into
masterfrom
suppress_cves_38.0.0

Commits on Sep 2, 2026
- Suppress CVEs that do not affect Druid
  kfaraz
  committed
  c42aa7b
Commits on Sep 3, 2026
- Suppress memcached CVEs
  kfaraz
  committed
  c4fb739
- Suppress uuid GHSA-w5hq-g745-h8pq (not applicable to Druid)
  
  kfaraz
  and
  claude
  committed
  8734482
Commits on Sep 4, 2026
- Fixes
  kfaraz
  committed
  a61e98d
Commits on Sep 7, 2026
- Suppress CVEs not applicable to Druid (azure, hive, hadoop shaded deps, opentelemetry, testcontainers)
  
  kfaraz
  and
  claude
  committed
  dcdee05
- fix: broaden suppression patterns for shaded Jetty and JLine in hadoop-client-runtime
  
  kfaraz
  and
  claude
  committed
  aa5ed14
Commits on Sep 8, 2026
- fix: broaden Jetty suppression to cover org.eclipse.jetty.* subgroups in hadoop-client-runtime
  
  kfaraz
  and
  claude
  committed
  7a25f0d
- Merge branch 'master' of github.com:apache/druid into suppress_cves_38.0.0
  kfaraz
  committed
  5605850
Commits on Sep 11, 2026
- Apply suppressions to shaded jars only
  kfaraz
  committed
  52f6a11
- No netty4 suppresion in master
  kfaraz
  committed
  2c49f66
- Simplify CVE suppression for memcached server stuff
  kfaraz
  committed
  b49f51a
- Update filePath regex to match shaded jar correctly
  kfaraz
  committed
  d535f9c
- Update notes
  kfaraz
  committed
  f81245a
- Update notes
  kfaraz
  committed
  442c8f6
Commits on Sep 12, 2026
- Broaden suppression
  kfaraz
  committed
  4fab6af
- Merge branch 'master' of github.com:apache/druid into suppress_cves_38.0.0
  kfaraz
  committed
  197887b
- Fix typo
  kfaraz
  committed
  cf9f0b1
- Broader suppression
  kfaraz
  committed
  fc0fb6e
- Suppress false positive
  kfaraz
  committed
  09526b4
Commits on Sep 13, 2026
- Suppress zstd-jni CVEs
  kfaraz
  committed
  e9d559f
Commits on Sep 14, 2026
- Include h2
  kfaraz
  committed
  ef27d59
- Merge branch 'master' of github.com:apache/druid into suppress_cves_38.0.0
  kfaraz
  committed
  897d36a
Commits on Oct 13, 2026
- Merge branch 'master' of github.com:apache/druid into suppress_cves_38.0.0
  kfaraz
  committed
  7b07003
- Add fail never so that all CVEs are flagged at once
  kfaraz
  committed
  4d5070b
Commits on Oct 14, 2026
- Latest suppressions
  kfaraz
  committed
  9678f56
- More suppressions
  kfaraz
  committed
  96cdd00
Commits on Oct 15, 2026
- Revert "Add fail never so that all CVEs are flagged at once"
  kfaraz
  committed
  59d6771

Commits

Commits on Sep 2, 2026

Commits on Sep 3, 2026

Commits on Sep 4, 2026

Commits on Sep 7, 2026

Commits on Sep 8, 2026

Commits on Sep 11, 2026

Commits on Sep 12, 2026

Commits on Sep 13, 2026

Commits on Sep 14, 2026

Commits on Oct 13, 2026

Commits on Oct 14, 2026

Commits on Oct 15, 2026