From 845f0d27bf1adaf1672961b9ba5ba4b4c8c2ed9c Mon Sep 17 00:00:00 2001 From: Arnab Nandy Date: Thu, 30 Jul 2026 20:17:25 +0530 Subject: [PATCH 1/2] Fix vulnerable Cosmos Spark dependencies Signed-off-by: Arnab Nandy --- sdk/cosmos/azure-cosmos-spark_3/pom.xml | 5 +++++ sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md | 2 ++ sdk/cosmos/azure-cosmos-spark_4-0_2-13/pom.xml | 4 ++++ sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md | 2 ++ sdk/cosmos/azure-cosmos-spark_4-1_2-13/pom.xml | 4 ++++ 5 files changed, 17 insertions(+) diff --git a/sdk/cosmos/azure-cosmos-spark_3/pom.xml b/sdk/cosmos/azure-cosmos-spark_3/pom.xml index 2405150dc171..2b307e36ee3d 100644 --- a/sdk/cosmos/azure-cosmos-spark_3/pom.xml +++ b/sdk/cosmos/azure-cosmos-spark_3/pom.xml @@ -136,6 +136,11 @@ + + org.apache.commons + commons-lang3 + 3.18.0 + com.fasterxml.jackson.module jackson-module-afterburner diff --git a/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md b/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md index 5f9d792231c9..bec9e8d852ab 100644 --- a/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md +++ b/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md @@ -10,6 +10,8 @@ #### Other Changes +* Updated Netty to `4.1.135.Final` and MSAL4J to `1.23.1`, and replaced `commons-lang` 2.6 with `commons-lang3` 3.18.0 in the shaded connector JAR. + ### 4.49.2 (2026-07-27) #### Bugs Fixed diff --git a/sdk/cosmos/azure-cosmos-spark_4-0_2-13/pom.xml b/sdk/cosmos/azure-cosmos-spark_4-0_2-13/pom.xml index 7e208a4df7b1..ff9b121e6022 100644 --- a/sdk/cosmos/azure-cosmos-spark_4-0_2-13/pom.xml +++ b/sdk/cosmos/azure-cosmos-spark_4-0_2-13/pom.xml @@ -192,6 +192,10 @@ io.netty netty-all + + commons-lang + commons-lang + org.slf4j * diff --git a/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md b/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md index 118ebba13412..923a39ff02de 100644 --- a/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md +++ b/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md @@ -10,6 +10,8 @@ #### Other Changes +* Updated Netty to `4.1.135.Final` and MSAL4J to `1.23.1`, and replaced `commons-lang` 2.6 with `commons-lang3` 3.18.0 in the shaded connector JAR. + ### 4.49.2 (2026-07-27) #### Bugs Fixed diff --git a/sdk/cosmos/azure-cosmos-spark_4-1_2-13/pom.xml b/sdk/cosmos/azure-cosmos-spark_4-1_2-13/pom.xml index 81802fe1e018..c856d18de21e 100644 --- a/sdk/cosmos/azure-cosmos-spark_4-1_2-13/pom.xml +++ b/sdk/cosmos/azure-cosmos-spark_4-1_2-13/pom.xml @@ -239,6 +239,10 @@ io.netty netty-all + + commons-lang + commons-lang + org.slf4j * From 4b5ce944422dfd7fe20bfc7a8d7877b2a82216a0 Mon Sep 17 00:00:00 2001 From: Arnab Nandy Date: Thu, 30 Jul 2026 20:40:46 +0530 Subject: [PATCH 2/2] Address Cosmos Spark dependency review feedback Signed-off-by: Arnab Nandy --- sdk/cosmos/azure-cosmos-spark_3/pom.xml | 1 + sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md | 2 +- sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/sdk/cosmos/azure-cosmos-spark_3/pom.xml b/sdk/cosmos/azure-cosmos-spark_3/pom.xml index 2b307e36ee3d..227ba4b475e0 100644 --- a/sdk/cosmos/azure-cosmos-spark_3/pom.xml +++ b/sdk/cosmos/azure-cosmos-spark_3/pom.xml @@ -140,6 +140,7 @@ org.apache.commons commons-lang3 3.18.0 + test com.fasterxml.jackson.module diff --git a/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md b/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md index bec9e8d852ab..07ccee3658b7 100644 --- a/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md +++ b/sdk/cosmos/azure-cosmos-spark_4-0_2-13/CHANGELOG.md @@ -10,7 +10,7 @@ #### Other Changes -* Updated Netty to `4.1.135.Final` and MSAL4J to `1.23.1`, and replaced `commons-lang` 2.6 with `commons-lang3` 3.18.0 in the shaded connector JAR. +* Excluded `commons-lang` 2.6 from the shaded connector JAR. The existing `azure-core-http-netty` 1.16.5 and `azure-identity` 1.18.4 dependencies provide Netty 4.1.135.Final and MSAL4J 1.23.1, respectively. ### 4.49.2 (2026-07-27) diff --git a/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md b/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md index 923a39ff02de..e1a267aa3ffb 100644 --- a/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md +++ b/sdk/cosmos/azure-cosmos-spark_4-1_2-13/CHANGELOG.md @@ -10,7 +10,7 @@ #### Other Changes -* Updated Netty to `4.1.135.Final` and MSAL4J to `1.23.1`, and replaced `commons-lang` 2.6 with `commons-lang3` 3.18.0 in the shaded connector JAR. +* Excluded `commons-lang` 2.6 from the shaded connector JAR. The existing `azure-core-http-netty` 1.16.5 and `azure-identity` 1.18.4 dependencies provide Netty 4.1.135.Final and MSAL4J 1.23.1, respectively. ### 4.49.2 (2026-07-27)