diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ddcbbd5d..9ea82b884 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,7 @@ All notable changes to this project will be documented in this file. - superset: Add version `4.1.1` ([#991]). - Add Patchable patch management tool ([#1003], [#1005], [#1007]). - nifi: Add 1.28.1, 2.2.0 ([#1006]). +- spark: Add 3.5.5 ([#1022]) ### Changed @@ -50,6 +51,7 @@ All notable changes to this project will be documented in this file. - trino-storage-connector: Remove version 469 ([#999]). - nifi: Remove 2.0.0 ([#1006]). - druid: Remove 26.0.0 ([#984]) +- spark: Remove 3.5.1 ([#1022]) ### Fixed @@ -88,6 +90,7 @@ All notable changes to this project will be documented in this file. [#1006]: https://github.com/stackabletech/docker-images/pull/1006 [#1007]: https://github.com/stackabletech/docker-images/pull/1007 [#1013]: https://github.com/stackabletech/docker-images/pull/1013 +[#1022]: https://github.com/stackabletech/docker-images/pull/1022 ## [24.11.1] - 2025-01-14 diff --git a/rust/patchable/README.md b/rust/patchable/README.md index 8bb56a04d..a22fc5e97 100644 --- a/rust/patchable/README.md +++ b/rust/patchable/README.md @@ -25,7 +25,7 @@ For more details, run `cargo patchable --help`. ## Notes - patchable only supports linear patch series (no merges beyond the base commit) -- patchable doesn't support support merging "materialized" trees, merge the .patch files instead, and `checkout`/`export` to update the hashes +- patchable doesn't support merging "materialized" trees, merge the .patch files instead, and `checkout`/`export` to update the hashes - `patchable checkout` doesn't support resolving patch conflicts, use `git am` instead (and then `patchable export` the resolved patches) - Always run patchable via `cargo patchable` (rather than `cargo install`ing it), to ensure that you use the correct version for a given checkout of docker-images diff --git a/spark-k8s/stackable/patches/3.5.1/0002-Fix-CVE-2024-36114.patch b/spark-k8s/stackable/patches/3.5.1/0002-Fix-CVE-2024-36114.patch deleted file mode 100644 index e38fd4825..000000000 --- a/spark-k8s/stackable/patches/3.5.1/0002-Fix-CVE-2024-36114.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3892892d934387d20c6d8fd45f126e054bef55b8 Mon Sep 17 00:00:00 2001 -From: Siegfried Weber -Date: Mon, 11 Nov 2024 10:00:15 +0100 -Subject: Fix CVE-2024-36114 - -see https://github.com/stackabletech/vulnerabilities/issues/834 - -Aircompressor is a library with ports of the Snappy, LZO, LZ4, and -Zstandard compression algorithms to Java. All decompressor -implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash -the JVM for certain input, and in some cases also leak the content of -other memory of the Java process (which could contain sensitive -information). When decompressing certain data, the decompressors try to -access memory outside the bounds of the given byte arrays or byte -buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to -speed up memory access, no additional bounds checks are performed and -this has similar security consequences as out-of-bounds access in C or -C++, namely it can lead to non-deterministic behavior or crash the JVM. -Users should update to Aircompressor 0.27 or newer where these issues -have been fixed. When decompressing data from untrusted users, this can -be exploited for a denial-of-service attack by crashing the JVM, or to -leak other sensitive information from the Java process. There are no -known workarounds for this issue. ---- - pom.xml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pom.xml b/pom.xml -index 6cca7db7bf..fb9254e0cd 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -2558,7 +2558,7 @@ - - io.airlift - aircompressor -- 0.26 -+ 0.27 - - - org.apache.orc diff --git a/spark-k8s/stackable/patches/3.5.1/patchable.toml b/spark-k8s/stackable/patches/3.5.1/patchable.toml deleted file mode 100644 index feaeca0cb..000000000 --- a/spark-k8s/stackable/patches/3.5.1/patchable.toml +++ /dev/null @@ -1,2 +0,0 @@ -upstream = "https://github.com/apache/spark.git" -base = "fd86f85e181fc2dc0f50a096855acf83a6cc5d9c" diff --git a/spark-k8s/stackable/patches/3.5.1/0001-Update-CycloneDX-plugin.patch b/spark-k8s/stackable/patches/3.5.5/0001-Update-CycloneDX-plugin.patch similarity index 82% rename from spark-k8s/stackable/patches/3.5.1/0001-Update-CycloneDX-plugin.patch rename to spark-k8s/stackable/patches/3.5.5/0001-Update-CycloneDX-plugin.patch index b0cbf6b65..f1cf7df81 100644 --- a/spark-k8s/stackable/patches/3.5.1/0001-Update-CycloneDX-plugin.patch +++ b/spark-k8s/stackable/patches/3.5.5/0001-Update-CycloneDX-plugin.patch @@ -1,6 +1,6 @@ -From 08b7c02a497b8b3b70616281f810a898b1719a78 Mon Sep 17 00:00:00 2001 -From: Lukas Voetmand -Date: Fri, 6 Sep 2024 17:53:52 +0200 +From 37ad7dcbb2a77267bbddafc4f3b3d99fddda0b28 Mon Sep 17 00:00:00 2001 +From: Razvan-Daniel Mihai <84674+razvan@users.noreply.github.com> +Date: Tue, 11 Mar 2025 17:29:39 +0200 Subject: Update CycloneDX plugin --- @@ -21,10 +21,10 @@ index ef7c010e93..0f4c1c74e4 100755 # Actually build the jar diff --git a/pom.xml b/pom.xml -index 0f504dbee8..6cca7db7bf 100644 +index 9b009c3a42..483dceb8ea 100644 --- a/pom.xml +++ b/pom.xml -@@ -3482,7 +3482,12 @@ +@@ -3534,7 +3534,12 @@ org.cyclonedx cyclonedx-maven-plugin diff --git a/spark-k8s/stackable/patches/3.5.5/patchable.toml b/spark-k8s/stackable/patches/3.5.5/patchable.toml new file mode 100644 index 000000000..1e901f3f3 --- /dev/null +++ b/spark-k8s/stackable/patches/3.5.5/patchable.toml @@ -0,0 +1,2 @@ +upstream = "https://github.com/apache/spark.git" +base = "7c29c664cdc9321205a98a14858aaf8daaa19db2" diff --git a/spark-k8s/versions.py b/spark-k8s/versions.py index f50be6745..d00619a16 100644 --- a/spark-k8s/versions.py +++ b/spark-k8s/versions.py @@ -1,6 +1,6 @@ versions = [ { - "product": "3.5.1", + "product": "3.5.2", "java-base": "17", "java-devel": "17", "python": "3.11", @@ -13,12 +13,12 @@ "stax2_api": "4.2.1", # https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2 "woodstox_core": "6.5.1", # https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2 "vector": "0.43.1", - "jmx_exporter": "1.0.1-stackable", + "jmx_exporter": "1.1.0", "tini": "0.19.0", "hbase_connector": "1.0.1", }, { - "product": "3.5.2", + "product": "3.5.5", "java-base": "17", "java-devel": "17", "python": "3.11", @@ -31,7 +31,7 @@ "stax2_api": "4.2.1", # https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2 "woodstox_core": "6.5.1", # https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml/2.15.2 "vector": "0.43.1", - "jmx_exporter": "1.0.1-stackable", + "jmx_exporter": "1.1.0", "tini": "0.19.0", "hbase_connector": "1.0.1", },