MartijnVisser commented on PR #204: URL: https://github.com/apache/flink-connector-jdbc/pull/204#issuecomment-5760896117
Same answer as #80, and it can no longer change. > Users should upgrade to Java 21 and Derby 10.17.1.0. Alternatively, users who wish to remain on older Java versions should build their own Derby distribution from one of the release families to which the fix was backported: 10.16, 10.15, and 10.14. From https://nvd.nist.gov/vuln/detail/CVE-2022-46337 No release was ever cut from those branches, and the Derby developers voted on 2025-10-10 to retire the project into a read-only state, so none ever will be: https://issues.apache.org/jira/browse/DERBY-7177 That leaves 10.17.1.0, which needs Java 21 while we build and test on JDK 17. Derby is test scope here and runs embedded without authentication, so the CVE is not reachable either way. I've opened https://issues.apache.org/jira/browse/FLINK-40730 for what we do with the Derby dialect now that upstream is gone. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
