Skip to content

Conversation

@Akanksha-kedia
Copy link
Contributor

@Akanksha-kedia Akanksha-kedia commented Sep 29, 2025

Description

Screenshot 2025-09-29 at 2 41 46 PM Screenshot 2025-09-29 at 3 10 46 PM

Additional context and related issues

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.

@cla-bot cla-bot bot added the cla-signed label Sep 29, 2025
@Akanksha-kedia
Copy link
Contributor Author

@mosabua please review.

Copy link
Member

@mosabua mosabua left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Airlift change makes no sense.

@Akanksha-kedia Akanksha-kedia changed the title Fix the vulnerability in postgresql and jetty-http2-common Fix the vulnerability in postgresql Sep 30, 2025
@Akanksha-kedia
Copy link
Contributor Author

have avoided jetty and only kept postgresql
@mosabua @ebyhr please review

@ebyhr
Copy link
Member

ebyhr commented Sep 30, 2025

@Akanksha-kedia Please update the commit title.

@ebyhr ebyhr merged commit 92e9274 into trinodb:main Sep 30, 2025
2 of 3 checks passed
@github-actions github-actions bot added this to the 17 milestone Sep 30, 2025
@mosabua
Copy link
Member

mosabua commented Sep 30, 2025

In the future please do NOT use a misleading commit message like this. The change just does an update of the dependency. There was no exploit documented as possible before this change. If you really want to include more info you can do it as a separate text after the commit message and then link to the actual CVE report.

Maybe like so:

Update PostgreSQL JDBC driver to 42.7.8

- Removes reporting for CVE xyz.
- No known exploit existed before this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

3 participants