From a0e4a656e57725aac5aafdd36751fc820a9d502e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 05:39:44 +0000 Subject: [PATCH 1/2] Bump org.xerial.snappy:snappy-java in /openam-cassandra Bumps [org.xerial.snappy:snappy-java](https://github.com/xerial/snappy-java) from 1.1.10.5 to 1.1.10.9. - [Release notes](https://github.com/xerial/snappy-java/releases) - [Commits](https://github.com/xerial/snappy-java/compare/v1.1.10.5...v1.1.10.9) --- updated-dependencies: - dependency-name: org.xerial.snappy:snappy-java dependency-version: 1.1.10.9 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- openam-cassandra/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openam-cassandra/pom.xml b/openam-cassandra/pom.xml index 4ed9de9663..6ea33d1c66 100644 --- a/openam-cassandra/pom.xml +++ b/openam-cassandra/pom.xml @@ -44,7 +44,7 @@ org.xerial.snappy snappy-java - 1.1.10.5 + 1.1.10.9 com.google.guava From 9ddd52c099707adbbf5d9f1ed4dcbdfe3f81a44d Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Wed, 28 Oct 2026 10:35:20 +0300 Subject: [PATCH 2/2] Bump org.xerial.snappy:snappy-java to 1.1.10.12 1.1.10.9 still leaves GHSA-c73m-r934-8qvg (CVE-2026-108104, double release of pooled buffers in SnappyFramedInputStream) and GHSA-6gp7-6wmv-gxqw (uncontrolled recursion and eager chunk allocation in SnappyInputStream) open; both are fixed in 1.1.10.10. 1.1.10.11 and 1.1.10.12 only restore Hadoop ByteBuffer compression compatibility. --- openam-cassandra/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openam-cassandra/pom.xml b/openam-cassandra/pom.xml index 6ea33d1c66..f687c704f8 100644 --- a/openam-cassandra/pom.xml +++ b/openam-cassandra/pom.xml @@ -44,7 +44,7 @@ org.xerial.snappy snappy-java - 1.1.10.9 + 1.1.10.12 com.google.guava