Skip to content

Update dependency org.apache.parquet:parquet-avro to v1.15.1#162

Open
dev-mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/org.apache.parquet-parquet-avro-1.x
Open

Update dependency org.apache.parquet:parquet-avro to v1.15.1#162
dev-mend-for-github-com[bot] wants to merge 1 commit intomasterfrom
whitesource-remediate/org.apache.parquet-parquet-avro-1.x

Conversation

@dev-mend-for-github-com
Copy link
Copy Markdown

@dev-mend-for-github-com dev-mend-for-github-com Bot commented Feb 25, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
org.apache.parquet:parquet-avro (source) compile minor 1.8.2 → 1.15.1

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score Vulnerability Reachability
Critical Critical 10.0 CVE-2025-30065
High High 8.3 CVE-2025-46762

Release Notes

apache/parquet-mr (org.apache.parquet:parquet-avro)

v1.14.1

Release Notes - Parquet - Version 1.14.1

Bug
  • PARQUET-2468 - ParquetMetadata.toPrettyJSON throws exception on file read when LOG.isDebugEnabled()
  • PARQUET-2498 - Hadoop vector IO API doesn't handle empty list of ranges

v1.14.0

Release Notes - Parquet - Version 1.14.0

Bug
  • PARQUET-2260 - Bloom filter bytes size shouldn't be larger than maxBytes size in the configuration
  • PARQUET-2266 - Fix support for files without ColumnIndexes
  • PARQUET-2276 - ParquetReader reads do not work with Hadoop version 2.8.5
  • PARQUET-2300 - Update jackson-core 2.13.4 to a version without CVE PRISMA-2023-0067
  • PARQUET-2325 - Fix parquet-cli's dictionary subcommand to work with FIXED_LEN_BYTE_ARRAY
  • PARQUET-2329 - Fix wrong help messages of parquet-cli subcommands
  • PARQUET-2330 - Fix convert-csv to show the correct position of the invalid record
  • PARQUET-2332 - Fix unexpectedly disabled tests to be executed
  • PARQUET-2336 - Add caching key to CodecFactory
  • PARQUET-2342 - Parquet writer produced a corrupted file due to page value count overflow
  • PARQUET-2343 - Fixes NPE when rewriting file with multiple rowgroups
  • PARQUET-2348 - Recompression/Re-encrypt should rewrite bloomfilter
  • PARQUET-2354 - Apparent race condition in CharsetValidator
  • PARQUET-2363 - ParquetRewriter should encrypt the V2 page header
  • PARQUET-2365 - Fixes NPE when rewriting column without column index
  • PARQUET-2408 - Fix license header in .gitattributes
  • PARQUET-2420 - ThriftParquetWriter converts thrift byte to int32 without adding logical type
  • PARQUET-2429 - Direct buffer churn in NonBlockedDecompressor
  • PARQUET-2438 - Fixes minMaxSize for BinaryColumnIndexBuilder
  • PARQUET-2442 - Remove Parquet Site from parquet-mr
  • PARQUET-2448 - parquet-avro does not support nested logical-type for avro <= 1.8
  • PARQUET-2449 - Writing using LocalOutputFile creates a large buffer
  • PARQUET-2450 - ParquetAvroReader throws exception projecting a single field of a repeated record type
  • PARQUET-2456 - avro schema conversion may fail with name conflict when using fixed types
  • PARQUET-2457 - Missing maven-scala-plugin version
  • PARQUET-2458 - Java compiler should use release instead of source/target
  • PARQUET-2465 - Fall back to Hadoop Configuration
New Feature
Improvement
Test
  • PARQUET-2361 - Reduce failure rate of unit test testParquetFileWithBloomFilterWithFpp
Task

v1.13.1

Release Notes - Parquet - Version 1.13.1

Improvement

v1.13.0

Release Notes - Parquet - Version 1.13.0

New Feature
  • PARQUET-1020 - Add support for Dynamic Messages in parquet-protobuf
Task
  • PARQUET-2230 - Add a new rewrite command powered by ParquetRewriter
  • PARQUET-2228 - ParquetRewriter supports more than one input file
  • PARQUET-2229 - ParquetRewriter supports masking and encrypting the same column
  • PARQUET-2227 - Refactor different file rewriters to use single implementation
Improvement
Bug
  • PARQUET-2202 - Redundant String allocation on the hot path in CapacityByteArrayOutputStream.setByte
  • PARQUET-2164 - CapacityByteArrayOutputStream overflow while writing causes negative row group sizes to be written
  • PARQUET-2103 - Fix crypto exception in print toPrettyJSON
  • PARQUET-2251 - Avoid generating Bloomfilter when all pages of a column are encoded by dictionary
  • PARQUET-2243 - Support zstd-jni in DirectCodecFactory
  • PARQUET-2247 - Fail-fast if CapacityByteArrayOutputStream write overflow
  • PARQUET-2241 - Fix ByteStreamSplitValuesReader with nulls
  • PARQUET-2244 - Fix notIn for columns with null values
  • PARQUET-2173 - Fix parquet build against hadoop 3.3.3+
  • PARQUET-2219 - ParquetFileReader skips empty row group
  • PARQUET-2198 - Updating jackson data bind version to fix CVEs
  • PARQUET-2177 - Fix parquet-cli not to fail showing descriptions
  • PARQUET-1711 - Support recursive proto schemas by limiting recursion depth
  • PARQUET-2142 - parquet-cli without hadoop throws java.lang.NoSuchMethodError on any parquet file access command
  • PARQUET-2160 - Close decompression stream to free off-heap memory in time
  • PARQUET-2185 - ParquetReader constructed using builder fails to read encrypted files
  • PARQUET-2167 - CLI show footer command fails if Parquet file contains date fields
  • PARQUET-2134 - Incorrect type checking in HadoopStreams.wrap
  • PARQUET-2161 - Fix row index generation in combination with range filtering
  • PARQUET-2154 - ParquetFileReader should close its input stream when filterRowGroups throw Exception in constructor
Test

v1.12.3

Release Notes - Parquet - Version 1.12.3

New Feature
  • PARQUET-2117 - Add rowPosition API in parquet record readers
Task
  • PARQUET-2081 - Encryption translation tool - Parquet-hadoop
Improvement
Bug

v1.12.2

Release Notes - Parquet - Version 1.12.2

Bug

v1.12.1

Release Notes - Parquet - Version 1.12.1

Bug
  • PARQUET-1633 - Fix integer overflow
  • PARQUET-2022 - ZstdDecompressorStream should close zstdInputStream
  • PARQUET-2027 - Fix calculating directory offset for merge
  • PARQUET-2052 - Integer overflow when writing huge binary using dictionary encoding
  • PARQUET-2054 - fix TCP leaking when calling ParquetFileWriter.appendFile
  • PARQUET-2072 - Do Not Determine Both Min/Max for Binary Stats
  • PARQUET-2073 - Fix estimate remaining row count in ColumnWriteStoreBase.
  • PARQUET-2078 - Failed to read parquet file after writing with the same parquet version
Improvement

v1.12.0

Release Notes - Parquet - Version 1.12.0

Sub-task
Bug
  • PARQUET-1438 - [C++] corrupted files produced on 32-bit architecture (i686)
  • PARQUET-1493 - maven protobuf plugin not work properly
  • PARQUET-1455 - [parquet-protobuf] Handle "unknown" enum values for parquet-protobuf
  • PARQUET-1554 - Compilation error when upgrading Scrooge version
  • PARQUET-1599 - Fix to-avro to respect the overwrite option
  • PARQUET-1684 - [parquet-protobuf] default protobuf field values are stored as nulls
  • PARQUET-1699 - Could not resolve org.apache.yetus:audience-annotations:0.11.0
  • PARQUET-1741 - APIs backward compatibility issues cause master branch build failure
  • PARQUET-1765 - Invalid filteredRowCount in InternalParquetRecordReader
  • PARQUET-1794 - Random data generation may cause flaky tests
  • PARQUET-1803 - Could not find FilleInputSplit in ParquetInputSplit
  • PARQUET-1808 - SimpleGroup.toString() uses String += and so has poor performance
  • PARQUET-1818 - Fix collision of encryption and bloom filters in format-structure Util
  • PARQUET-1850 - toParquetMetadata method in ParquetMetadataConverter does not set dictionary page offset bit
  • PARQUET-1851 - ParquetMetadataConveter throws NPE in an Iceberg unit test
  • PARQUET-1868 - Parquet reader options toggle for bloom filter toggles dictionary filtering
  • PARQUET-1879 - Apache Arrow can not read a Parquet File written with Parqet-Avro 1.11.0 with a Map field
  • PARQUET-1893 - H2SeekableInputStream readFully() doesn't respect start and len
  • PARQUET-1894 - Please fix the related Shaded Jackson Databind CVEs
  • PARQUET-1896 - [Maven] parquet-tools build is broken
  • PARQUET-1910 - Parquet-cli is broken after TransCompressionCommand was added
  • PARQUET-1917 - [parquet-proto] default values are stored in oneOf fields that aren't set
  • PARQUET-1920 - Fix issue with reading parquet files with too large column chunks
  • PARQUET-1923 - parquet-tools 1.11.0: TestSimpleRecordConverter fails with ExceptionInInitializerError on openjdk 15
  • PARQUET-1928 - Interpret Parquet INT96 type as FIXED[12] AVRO Schema
  • PARQUET-1944 - Unable to download transitive dependency hadoop-lzo
  • PARQUET-1947 - DeprecatedParquetInputFormat in CombineFileInputFormat would produce wrong data
  • PARQUET-1949 - Mark Parquet-1872 with not support bloom filter yet
  • PARQUET-1954 - TCP connection leak in parquet dump
  • PARQUET-1963 - DeprecatedParquetInputFormat in CombineFileInputFormat throw NPE when the first sub-split is empty
  • PARQUET-1966 - Fix build with JDK11 for JDK8
  • PARQUET-1970 - Make minor releases source compatible
  • PARQUET-1971 - Flaky test in github action
  • PARQUET-1975 - Test failure on ARM64 CPU architecture
  • PARQUET-1977 - Invalid data_page_offset
  • PARQUET-1979 - Optional bloom_filter_offset is filled if no bloom filter is present
  • PARQUET-1984 - Some tests fail on windows
  • PARQUET-1992 - Cannot build from tarball because of git submodules
  • PARQUET-1999 - NPE might occur if OutputFile is implemented by the client
New Feature
Improvement
Test
  • PARQUET-1832 - Travis fails with too long output
  • PARQUET-1980 - Build and test Apache Parquet on ARM64 CPU architecture
Wish
  • PARQUET-1717 - parquet-thrift converts Thrift i16 to parquet INT32 instead of INT_16
Task

v1.11.0

Release Notes - Parquet - Version 1.11.0

Bug
  • PARQUET-138 - Parquet should allow a merge between required and optional schemas
  • PARQUET-952 - Avro union with single type fails with 'is not a group'
  • PARQUET-1128 - [Java] Upgrade the Apache Arrow version to 0.8.0 for SchemaConverter
  • PARQUET-1281 - Jackson dependency
  • PARQUET-1285 - [Java] SchemaConverter should not convert from TimeUnit.SECOND AND TimeUnit.NANOSECOND of Arrow
  • PARQUET-1293 - Build failure when using Java 8 lambda expressions
  • PARQUET-1296 - Travis kills build after 10 minutes, because "no output was received"
  • PARQUET-1297 - [Java] SchemaConverter should not convert from Timestamp(TimeUnit.SECOND) and Timestamp(TimeUnit.NANOSECOND) of Arrow
  • PARQUET-1303 - Avro reflect @​Stringable field write error if field not instanceof CharSequence
  • PARQUET-1304 - Release 1.10 contains breaking changes for Hive
  • PARQUET-1305 - Backward incompatible change introduced in 1.8
  • PARQUET-1309 - Parquet Java uses incorrect stats and dictionary filter properties
  • PARQUET-1311 - Update README.md
  • PARQUET-1317 - ParquetMetadataConverter throw NPE
  • PARQUET-1341 - Null count is suppressed when columns have no min or max and use unsigned sort order
  • PARQUET-1344 - Type builders don't honor new logical types
  • PARQUET-1368 - ParquetFileReader should close its input stream for the failure in constructor
  • PARQUET-1371 - Time/Timestamp UTC normalization parameter doesn't work
  • PARQUET-1407 - Data loss on duplicate values with AvroParquetWriter/Reader
  • PARQUET-1417 - BINARY_AS_SIGNED_INTEGER_COMPARATOR fails with IOBE for the same arrays with the different length
  • PARQUET-1421 - InternalParquetRecordWriter logs debug messages at the INFO level
  • PARQUET-1440 - Parquet-tools: Decimal values stored in an int32 or int64 in the parquet file aren't displayed with their proper scale
  • PARQUET-1441 - SchemaParseException: Can't redefine: list in AvroIndexedRecordConverter
  • PARQUET-1456 - Use page index, ParquetFileReader throw ArrayIndexOutOfBoundsException
  • PARQUET-1460 - Fix javadoc errors and include javadoc checking in Travis checks
  • PARQUET-1461 - Third party code does not compile after parquet-mr minor version update
  • PARQUET-1470 - Inputstream leakage in ParquetFileWriter.appendFile
  • PARQUET-1472 - Dictionary filter fails on FIXED_LEN_BYTE_ARRAY
  • PARQUET-1475 - DirectCodecFactory's ParquetCompressionCodecException drops a passed in cause in one constructor
  • PARQUET-1478 - Can't read spec compliant, 3-level lists via parquet-proto
  • PARQUET-1480 - INT96 to avro not yet implemented error should mention deprecation
  • PARQUET-1485 - Snappy Decompressor/Compressor may cause direct memory leak
  • PARQUET-1488 - UserDefinedPredicate throw NPE
  • PARQUET-1496 - [Java] Update Scala for JDK 11 compatibility
  • PARQUET-1497 - [Java] javax annotations dependency missing for Java 11
  • PARQUET-1498 - [Java] Add instructions to install thrift via homebrew
  • PARQUET-1510 - Dictionary filter skips null values when evaluating not-equals.
  • PARQUET-1514 - ParquetFileWriter Records Compressed Bytes instead of Uncompressed Bytes
  • PARQUET-1527 - [parquet-tools] cat command throw java.lang.ClassCastException
  • PARQUET-1529 - Shade fastutil in all modules where used
  • PARQUET-1531 - Page row count limit causes empty pages to be written from MessageColumnIO
  • PARQUET-1533 - TestSnappy() throws OOM exception with Parquet-1485 change
  • PARQUET-1534 - [parquet-cli] Argument error: Illegal character in opaque part at index 2 on Windows
  • PARQUET-1544 - Possible over-shading of modules
  • PARQUET-1550 - CleanUtil does not work in Java 11
  • PARQUET-1555 - Bump snappy-java to 1.1.7.3
  • PARQUET-1596 - PARQUET-1375 broke parquet-cli's to-avro command
  • PARQUET-1600 - Fix shebang in parquet-benchmarks/run.sh
  • PARQUET-1615 - getRecordWriter shouldn't hardcode CREAT mode when new ParquetFileWriter
  • PARQUET-1637 - Builds are failing because default jdk changed to openjdk11 on Travis
  • PARQUET-1644 - Clean up some benchmark code and docs.
  • PARQUET-1691 - Build fails due to missing hadoop-lzo
New Feature
Improvement

@dev-mend-for-github-com dev-mend-for-github-com Bot added the security fix Security fix generated by Mend label Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security fix Security fix generated by Mend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants