From f9c770a7f9d7c73a15323b8dda1b4af214a8162d Mon Sep 17 00:00:00 2001 From: dervoeti Date: Wed, 4 Nov 2026 11:29:07 +0100 Subject: [PATCH 1/3] fix(superset): Bump brotli to 1.2.1 to fix CVE-2026-111497 --- CHANGELOG.md | 1 + superset/stackable/constraints/4.1.4/constraints.txt | 2 +- superset/stackable/constraints/6.1.0/constraints.txt | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94e8e3458..4fbc321e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -114,6 +114,7 @@ All notable changes to this project will be documented in this file. - superset: Bump certifi to `2026.10.23` and uv to `0.13.4` ([#1715]). - opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([#1715]). - spark-connect-client: Point grpcio to the system trust store ([#1715]). +- superset: Bump brotli to `1.2.1` to fix CVE-2026-111497. - hbase: Add `hadoop-azure` to the HBase `lib` directory again, so that `abfs://` works. This regressed in 26.7.0 with [#1511] ([#1731]). ### Removed diff --git a/superset/stackable/constraints/4.1.4/constraints.txt b/superset/stackable/constraints/4.1.4/constraints.txt index 8e1613e99..5cba2964d 100644 --- a/superset/stackable/constraints/4.1.4/constraints.txt +++ b/superset/stackable/constraints/4.1.4/constraints.txt @@ -26,7 +26,7 @@ blinker==1.8.2 # via flask bottleneck==1.3.8 # via pandas -brotli==1.1.0 +brotli==1.2.1 # via flask-compress cachelib==0.9.0 # via diff --git a/superset/stackable/constraints/6.1.0/constraints.txt b/superset/stackable/constraints/6.1.0/constraints.txt index 71b81616a..0da3770f3 100644 --- a/superset/stackable/constraints/6.1.0/constraints.txt +++ b/superset/stackable/constraints/6.1.0/constraints.txt @@ -35,7 +35,7 @@ blinker==1.9.0 # via flask bottleneck==1.5.0 # via apache-superset (pyproject.toml) -brotli==1.2.0 +brotli==1.2.1 # via # -r requirements/base.in # flask-compress From 734719631b079b8ede6be84053561ce5109c42a7 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Sat, 7 Nov 2026 11:40:20 +0100 Subject: [PATCH 2/3] fix(nifi): Bump Hazelcast to 5.7.0 to fix CVE-2026-107726 --- CHANGELOG.md | 1 + ...Hazelcast-from-5.5.0-to-5.7.0-to-fix.patch | 22 +++++++++++++++++++ ...Hazelcast-from-5.6.0-to-5.7.0-to-fix.patch | 22 +++++++++++++++++++ 3 files changed, 45 insertions(+) create mode 100644 nifi/stackable/patches/2.6.0/0013-NIFI-15942-Bump-Hazelcast-from-5.5.0-to-5.7.0-to-fix.patch create mode 100644 nifi/stackable/patches/2.9.0/0014-NIFI-15942-Bump-Hazelcast-from-5.6.0-to-5.7.0-to-fix.patch diff --git a/CHANGELOG.md b/CHANGELOG.md index 4fbc321e2..bdf9acc1d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -114,6 +114,7 @@ All notable changes to this project will be documented in this file. - superset: Bump certifi to `2026.10.23` and uv to `0.13.4` ([#1715]). - opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([#1715]). - spark-connect-client: Point grpcio to the system trust store ([#1715]). +- nifi: Bump Hazelcast to `5.7.0` (partial backport of [NIFI-15942](https://issues.apache.org/jira/browse/NIFI-15942)) to fix CVE-2026-107726, for `2.6.0` and `2.9.0`. - superset: Bump brotli to `1.2.1` to fix CVE-2026-111497. - hbase: Add `hadoop-azure` to the HBase `lib` directory again, so that `abfs://` works. This regressed in 26.7.0 with [#1511] ([#1731]). diff --git a/nifi/stackable/patches/2.6.0/0013-NIFI-15942-Bump-Hazelcast-from-5.5.0-to-5.7.0-to-fix.patch b/nifi/stackable/patches/2.6.0/0013-NIFI-15942-Bump-Hazelcast-from-5.5.0-to-5.7.0-to-fix.patch new file mode 100644 index 000000000..76be9a3c4 --- /dev/null +++ b/nifi/stackable/patches/2.6.0/0013-NIFI-15942-Bump-Hazelcast-from-5.5.0-to-5.7.0-to-fix.patch @@ -0,0 +1,22 @@ +From ff477029b4b343d4fcab23dc6b74a86f27f1e46c Mon Sep 17 00:00:00 2001 +From: dervoeti +Date: Mon, 2 Nov 2026 20:41:48 +0000 +Subject: NIFI-15942 Bump Hazelcast from 5.5.0 to 5.7.0 to fix CVE-2026-107726 + +--- + .../nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml +index 259ab9def0866205bc1c3ac598d5946c73a63fc0..8190f5849ced7c1daabdc0f358aecec3a3b666bf 100644 +--- a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml ++++ b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml +@@ -43,7 +43,7 @@ + + com.hazelcast + hazelcast +- 5.5.0 ++ 5.7.0 + + + diff --git a/nifi/stackable/patches/2.9.0/0014-NIFI-15942-Bump-Hazelcast-from-5.6.0-to-5.7.0-to-fix.patch b/nifi/stackable/patches/2.9.0/0014-NIFI-15942-Bump-Hazelcast-from-5.6.0-to-5.7.0-to-fix.patch new file mode 100644 index 000000000..42e7c0b29 --- /dev/null +++ b/nifi/stackable/patches/2.9.0/0014-NIFI-15942-Bump-Hazelcast-from-5.6.0-to-5.7.0-to-fix.patch @@ -0,0 +1,22 @@ +From d7a0d94c5b8645a55164e135d5ddfb4fbe80a6e0 Mon Sep 17 00:00:00 2001 +From: dervoeti +Date: Mon, 2 Nov 2026 20:45:28 +0000 +Subject: NIFI-15942 Bump Hazelcast from 5.6.0 to 5.7.0 to fix CVE-2026-107726 + +--- + .../nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml +index 6286456e5c1a31f81cd8b5142bf4ccbdc9405e9f..1c87399ae758358c98116115b13a0dba1535df80 100644 +--- a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml ++++ b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml +@@ -43,7 +43,7 @@ + + com.hazelcast + hazelcast +- 5.6.0 ++ 5.7.0 + + + From 92f89a502b38cf5e9b5c275edeac866b44ccbbd7 Mon Sep 17 00:00:00 2001 From: dervoeti Date: Sat, 7 Nov 2026 11:48:50 +0100 Subject: [PATCH 3/3] chore: Add PR number to the changelog entries --- CHANGELOG.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bdf9acc1d..6fb1c3e79 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -114,8 +114,8 @@ All notable changes to this project will be documented in this file. - superset: Bump certifi to `2026.10.23` and uv to `0.13.4` ([#1715]). - opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([#1715]). - spark-connect-client: Point grpcio to the system trust store ([#1715]). -- nifi: Bump Hazelcast to `5.7.0` (partial backport of [NIFI-15942](https://issues.apache.org/jira/browse/NIFI-15942)) to fix CVE-2026-107726, for `2.6.0` and `2.9.0`. -- superset: Bump brotli to `1.2.1` to fix CVE-2026-111497. +- nifi: Bump Hazelcast to `5.7.0` (partial backport of [NIFI-15942](https://issues.apache.org/jira/browse/NIFI-15942)) to fix CVE-2026-107726, for `2.6.0` and `2.9.0` ([#1737]). +- superset: Bump brotli to `1.2.1` to fix CVE-2026-111497 ([#1737]). - hbase: Add `hadoop-azure` to the HBase `lib` directory again, so that `abfs://` works. This regressed in 26.7.0 with [#1511] ([#1731]). ### Removed @@ -202,6 +202,7 @@ All notable changes to this project will be documented in this file. [#1731]: https://github.com/stackabletech/docker-images/pull/1731 [#1732]: https://github.com/stackabletech/docker-images/pull/1732 [#1735]: https://github.com/stackabletech/docker-images/pull/1735 +[#1737]: https://github.com/stackabletech/docker-images/pull/1737 ## [26.7.0] - 2026-07-21