Skip to content

minor: suppress CVE-2026-68494 as non-applicable - #20615

Merged
kfaraz merged 1 commit into
apache:masterfrom
Fly-Style:sasha/fix-cve
Oct 16, 2026
Merged

kfaraz merged 1 commit into
apache:masterfrom
Fly-Style:sasha/fix-cve

Conversation

@Fly-Style

Copy link
Copy Markdown
Contributor

@Fly-Style
Fly-Style requested a review from kfaraz October 16, 2026 10:00
@Fly-Style Fly-Style changed the title minor: suppress CVE-2026-68494 as non-targetable minor: suppress CVE-2026-68494 as non-applicable Oct 16, 2026

@FrankChen021 FrankChen021 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No actionable issues found. The suppression is valid XML, scoped to the existing shaded jackson-core artifact path, and matches Hadoop’s shaded Jackson 2.18.6 without affecting Druid’s direct Jackson dependency. No Druid source call sites for the non-blocking Jackson parser were found.

Reviewed 1 of 1 changed files.

Validation: xmllint --noout passed; git diff --check passed.


This is an automated review by Codex GPT-5.6-Luna(max)

@kfaraz
kfaraz merged commit 206e3c9 into apache:master Oct 16, 2026
27 of 29 checks passed
@github-actions github-actions Bot added this to the 39.0.0 milestone Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants