MINOR: Upgrade thrift to 0.24 - #3730
Conversation
Fokko
left a comment
Fokko
left a comment
There was a problem hiding this comment.
LGTM, We might need something similar in parquet-format :)
| ``` | ||
| brew install thrift | ||
| export PATH="/usr/local/opt/thrift@0.23.0/bin:$PATH" | ||
| export PATH="$(brew --prefix thrift)/bin:$PATH" |
There was a problem hiding this comment.
Unfortunally, this is an improvement since brew does not keep the old Thrift versions
explore-with-yasir
left a comment
explore-with-yasir
left a comment
There was a problem hiding this comment.
+1 to this upgrade
one additional data point in its favor beyond the brew situation: Thrift 0.24.0 also resolves three CVEs filed against earlier Thrift lines (CVE-2026-43871, CVE-2026-45112, CVE-2026-48586). Because parquet-format-structures shades the Thrift classes into its published jar, SCA scanners attribute those advisories to every application that ships the jar, so this bump quietly clears findings for downstream users that they cannot fix through their own dependency management.
3 participants
I was testing a PR and couldn't
brew installthrift 0.23, because only 0.24 is available. So this PR does two things:Dockerfilethat developers can use that removes the dependency on a locally installed copy of thrift (and any other dependency).I find solutions like the Dockerfile to be really useful, but if maintainers feel its not appropriate to add to the repo I would certainly understand. The part can be reverted and the thrift upgrade will work just fine.