fix(superset,nifi): Bump brotli and Hazelcast to fix CVEs

CHANGELOG.md

@@ -114,6 +114,8 @@ All notable changes to this project will be documented in this file.
 - superset: Bump certifi to `2026.10.23` and uv to `0.13.4` ([#1715]).
 - opensearch-dashboards: Use the system trust store for Node.js instead of its bundled root certificates ([#1715]).
 - spark-connect-client: Point grpcio to the system trust store ([#1715]).
+- nifi: Bump Hazelcast to `5.7.0` (partial backport of [NIFI-15942](https://issues.apache.org/jira/browse/NIFI-15942)) to fix CVE-2026-107726, for `2.6.0` and `2.9.0` ([#1737]).
+- superset: Bump brotli to `1.2.1` to fix CVE-2026-111497 ([#1737]).
 - hbase: Add `hadoop-azure` to the HBase `lib` directory again, so that `abfs://` works. This regressed in 26.7.0 with [#1511] ([#1731]).
 
 ### Removed
@@ -200,6 +202,7 @@ All notable changes to this project will be documented in this file.
 [#1731]: https://github.com/stackabletech/docker-images/pull/1731
 [#1732]: https://github.com/stackabletech/docker-images/pull/1732
 [#1735]: https://github.com/stackabletech/docker-images/pull/1735
+[#1737]: https://github.com/stackabletech/docker-images/pull/1737
 
 ## [26.7.0] - 2026-07-21
 

nifi/stackable/patches/2.6.0/0013-NIFI-15942-Bump-Hazelcast-from-5.5.0-to-5.7.0-to-fix.patch

@@ -0,0 +1,22 @@
+From ff477029b4b343d4fcab23dc6b74a86f27f1e46c Mon Sep 17 00:00:00 2001
+From: dervoeti <lukas.krug@stackable.tech>
+Date: Mon, 2 Nov 2026 20:41:48 +0000
+Subject: NIFI-15942 Bump Hazelcast from 5.5.0 to 5.7.0 to fix CVE-2026-107726
+
+---
+ .../nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml
+index 259ab9def0866205bc1c3ac598d5946c73a63fc0..8190f5849ced7c1daabdc0f358aecec3a3b666bf 100644
+--- a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml
++++ b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml
+@@ -43,7 +43,7 @@
+         <dependency>
+             <groupId>com.hazelcast</groupId>
+             <artifactId>hazelcast</artifactId>
+-            <version>5.5.0</version>
++            <version>5.7.0</version>
+         </dependency>
+     </dependencies>
+ </project>

nifi/stackable/patches/2.9.0/0014-NIFI-15942-Bump-Hazelcast-from-5.6.0-to-5.7.0-to-fix.patch

@@ -0,0 +1,22 @@
+From d7a0d94c5b8645a55164e135d5ddfb4fbe80a6e0 Mon Sep 17 00:00:00 2001
+From: dervoeti <lukas.krug@stackable.tech>
+Date: Mon, 2 Nov 2026 20:45:28 +0000
+Subject: NIFI-15942 Bump Hazelcast from 5.6.0 to 5.7.0 to fix CVE-2026-107726
+
+---
+ .../nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml
+index 6286456e5c1a31f81cd8b5142bf4ccbdc9405e9f..1c87399ae758358c98116115b13a0dba1535df80 100644
+--- a/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml
++++ b/nifi-extension-bundles/nifi-hazelcast-bundle/nifi-hazelcast-services/pom.xml
+@@ -43,7 +43,7 @@
+         <dependency>
+             <groupId>com.hazelcast</groupId>
+             <artifactId>hazelcast</artifactId>
+-            <version>5.6.0</version>
++            <version>5.7.0</version>
+         </dependency>
+     </dependencies>
+ </project>

superset/stackable/constraints/4.1.4/constraints.txt

@@ -26,7 +26,7 @@ blinker==1.8.2
     # via flask
 bottleneck==1.3.8
     # via pandas
-brotli==1.1.0
+brotli==1.2.1
     # via flask-compress
 cachelib==0.9.0
     # via

superset/stackable/constraints/6.1.0/constraints.txt

@@ -35,7 +35,7 @@ blinker==1.9.0
     # via flask
 bottleneck==1.5.0
     # via apache-superset (pyproject.toml)
-brotli==1.2.0
+brotli==1.2.1
     # via
     #   -r requirements/base.in
     #   flask-compress