Skip to content

Update Apache Thrift to 0.24.0 - #1681

Closed
vikrantpuppala wants to merge 1 commit into
databricks:mainfrom
vikrantpuppala:vp/fix-security-scan-20260909
Closed

Update Apache Thrift to 0.24.0#1681
vikrantpuppala wants to merge 1 commit into
databricks:mainfrom
vikrantpuppala:vp/fix-security-scan-20260909

Conversation

@vikrantpuppala

Copy link
Copy Markdown
Collaborator

Description

  • Upgrade bundled Apache Thrift from 0.23.0 to 0.24.0.
  • Address CVE-2026-43871 reported by the repository security scan.
  • Document the dependency update in the next release changelog.

Testing

  • mvn package -DskipTests -Ddependency-check.skip=true
  • mvn -pl jdbc-core dependency:tree -Dincludes=org.apache.thrift:libthrift -DskipTests -Ddependency-check.skip=true — resolves 0.24.0
  • Broad unit-test run: 3,638 tests passed. One JDK no-open-only allocator test was selected under the generic --add-opens JVM configuration; its documented filtered invocation passes and is unrelated to Thrift.
  • git diff --check

Telemetry Errors

  • Not applicable — this PR does not add or change a telemetry-visible error.
  • Applicable — the error uses DatabricksDriverErrorCode where appropriate, and any new code is uniquely numbered and tested.
  • Applicable — its driver/server/user classification is linked, or maintainer help is requested because the author cannot access the classification.

Additional Notes to the Reviewer

No runtime code changes are included.

Upgrade the bundled libthrift dependency to address CVE-2026-43871 and document the change in the next release notes.

Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
@vikrantpuppala

Copy link
Copy Markdown
Collaborator Author

Superseded by #1682, which uses a branch in the upstream Databricks repository. The fork branch is intentionally retained.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant