[Bug] Bundled dependencies with published CVEs in paimon-shade 0.8.0, paimon-format, paimon-api and the S3 plugin #10859

Search before asking

• I searched in the issues and found nothing similar.

Paimon version

2.1.0, and master (source at 071e9ee, nightly snapshot jars 2.2-20261029.000959).

Compute Engine

Not engine specific. The libraries are bundled in Paimon's own jars (paimon-api, paimon-format, paimon-s3), and through paimon-api and paimon-format also in paimon-bundle and paimon-flink-*.

Minimal reproduce step

Scan the released 2.1.0 jars, or the 2.2-SNAPSHOT jars, with Trivy (0.71.0, vulnerability DB of 2026-10-28):

trivy rootfs --scanners vuln <directory with the paimon-api, paimon-format, paimon-bundle and paimon-flink-1.20 jars>

Trivy finds the paimon-api and paimon-format rows below through the bundled pom.properties. The paimon-shade jars and the S3 plugin do not keep META-INF/maven, so scanners cannot see what is inside them. For those, I took the versions from the paimon-shade NOTICE and from mvn dependency:list on paimon-hadoop-shaded-3.4 and paimon-s3-impl. I then checked that the published jar contains the original artifact's classes byte for byte; for the relocated Jackson copies, I read the version from their PackageVersion class. Finally, I scanned the original artifacts.

What doesn't meet your expectations?

The bundled versions below have published advisories. Only critical, high and medium advisories are listed. This is a scanner-based inventory: I have not assessed whether Paimon's code paths reach the affected functionality. "Fixed in" is the lowest version line in which every listed advisory is fixed.

paimon-shade 0.8.0, the latest release; master pins paimon.shade.version 0.8.0. All of paimon-shade-jackson-2 and paimon-shade-guava-30 is inside paimon-api.

The Jackson upgrade in paimon-shade is already tracked in #7431 and apache/paimon-shade#22. I list it here so the inventory is complete.

paimon-format

paimon-api

paimon-s3 plugin. The contents are the same in 2.1.0 and 2.2-SNAPSHOT. Most of these come in through paimon-hadoop-shaded-3.4 (Hadoop 3.4.2); the unrelocated Jackson 2.12.6.1/2.14.2 and netty-codec-http/http2 4.1.115 come with the AWS SDKs.

Anything else?

Requested upgrades:

• a paimon-shade release with current Jackson (and SnakeYAML 2.x) and Guava, and master moving to it;
• protobuf-java 3.25.5 or later in paimon-format, and a replacement for commons-lang 2.6, which has no fixed 2.x release;
• httpcore5 and httpcore5-h2 5.4.3 or later, and httpclient5 5.6.3 or later;
• in the S3 plugin: snappy-java 1.1.10.9, a current netty 4.1.x, bcprov, commons-configuration2 and ion-java, plus Jackson and Guava as far as Hadoop and the AWS SDKs allow.

I only looked at the artifacts above, not at the other filesystem plugins.

Side note: some NOTICE files differ from what the jars contain.

• paimon-hadoop-shaded-3.4 lists commons-compress 1.21, commons-configuration2 2.1.1, commons-io 2.8.0, dnsjava 2.1.7 and woodstox-core 5.3.0. The jar contains 1.26.1, 2.10.1, 2.16.1, 3.6.1 and 5.4.0. The NOTICE does not mention the netty and Bouncy Castle classes the jar bundles.
• paimon-format lists Jackson 2.14.2 and commons-compress 1.22. Its pom.properties say 2.14.3 and 1.26.2.

Are you willing to submit a PR?

• I'm willing to submit a PR!