Yicong-Huang opened a new pull request, #6208: URL: https://github.com/apache/texera/pull/6208
### What changes were proposed in this PR? Upgrade Apache Iceberg from 1.7.1 to 1.9.2 in `common/workflow-core`. Iceberg 1.7.1 transitively pulls `org.apache.parquet:parquet-avro` 1.13.1, which is flagged by two open Dependabot alerts: - **CVE-2025-30065** (critical): schema parsing in the parquet-avro module allows arbitrary code execution; fixed in parquet 1.15.1. - **CVE-2025-46762** (high): fixed in parquet 1.15.2. Iceberg 1.9.2 is the smallest Iceberg release whose official dependency set pairs with parquet 1.15.2, clearing both alerts with the upstream-tested combination (rather than force-pinning parquet under an older Iceberg). Parquet is purely transitive — there is no direct `org.apache.parquet` usage in our code. One source change was required: Iceberg 1.9 added a `BiFunction` overload to `Parquet.DataWriteBuilder#createWriterFunc` and deprecated `GenericParquetWriter.buildWriter(MessageType)`, so the bare method reference in `IcebergTableWriter.flushBuffer` no longer eta-expands in Scala. Switched to the replacement API `GenericParquetWriter.create(Schema, MessageType)` via an explicit lambda. Resolved versions after this change: all `org.apache.parquet:*` artifacts at 1.15.2, all `org.apache.iceberg:*` artifacts at 1.9.2, avro at 1.12.0. ### Any related issues, documentation, discussions? Resolves #6207. Dependabot alerts: [#714](https://github.com/apache/texera/security/dependabot/714), [#716](https://github.com/apache/texera/security/dependabot/716). ### How was this PR tested? - `sbt Test/compile` passes across all modules. - `sbt WorkflowCore/test`: 458 tests pass. (The LakeFS/S3/LargeBinary suites abort identically on `main` — they require local MinIO/LakeFS infrastructure — unrelated to this change.) - Iceberg integration specs run locally with `-DtexeraTestMode=integration-only`: `IcebergDocumentSpec` (19 tests, exercises the modified Parquet writer path), `IcebergTableStatsSpec`, `IcebergDocumentConsoleMessagesSpec`, and `IcebergRestCatalogIntegrationSpec` (14 tests) — all pass. - Verified via `show WorkflowCore/Compile/dependencyClasspath` that the parquet family resolves to 1.15.2. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Fable 5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
