From 009caf9277924c4d5c70cac915e2e4e7c014a5b4 Mon Sep 17 00:00:00 2001
From: Calvin Kirs <guoqiang@selectdb.com>
Date: Wed, 29 Apr 2026 11:07:12 +0800
Subject: [PATCH 1/3] [fix](fe) address dependency check findings (#62858)

address dependency check findings
---
 fe/pom.xml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/fe/pom.xml b/fe/pom.xml
index c03a91b1b78a97..0b7d9f575ff135 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -278,8 +278,8 @@ under the License.
         <hikaricp.version>6.0.0</hikaricp.version>
         <thrift.version>0.16.0</thrift.version>
         <tomcat-embed.version>9.0.104</tomcat-embed.version>
-        <log4j2.version>2.25.3</log4j2.version>
-        <log4j-1.2.version>2.25.3</log4j-1.2.version>
+        <log4j2.version>2.25.4</log4j2.version>
+        <log4j-1.2.version>2.25.4</log4j-1.2.version>
         <mqtt.version>1.2.5</mqtt.version>
         <slf4j.version>2.0.17</slf4j.version>
         <metrics-core.version>4.0.2</metrics-core.version>
@@ -364,8 +364,8 @@ under the License.
         <antlr4.version>4.13.1</antlr4.version>
         <joda.version>2.8.1</joda.version>
         <project.scm.id>github</project.scm.id>
-        <spring.version>3.5.7</spring.version>
-        <spring-framework.version>6.2.12</spring-framework.version>
+        <spring.version>3.5.14</spring.version>
+        <spring-framework.version>6.2.18</spring-framework.version>
         <orc.version>1.8.4</orc.version>
         <zookeeper.version>3.9.3</zookeeper.version>
         <velocity-engine-core.version>2.4</velocity-engine-core.version>
@@ -930,6 +930,11 @@ under the License.
                 <artifactId>log4j-core</artifactId>
                 <version>${log4j2.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-web</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.apache.logging.log4j</groupId>
                 <artifactId>log4j-iostreams</artifactId>

From 20dc056768087c900b4717ef1d695b6449043a9f Mon Sep 17 00:00:00 2001
From: Calvin Kirs <guoqiang@selectdb.com>
Date: Tue, 9 Jun 2026 10:00:30 +0800
Subject: [PATCH 2/3] [chore](deps) remove unused commons-lang (2.x) from fe
 (#64196)

commons-lang 2.x is not referenced by any fe source code. It was only
declared in java-common and preload-extensions (bundled into the BE
java-extensions runtime classpath via the assembly) without being used.

- drop the commons-lang dependencyManagement entry and version property
from fe/pom.xml
- drop the unused direct dependency from java-common and
preload-extensions
- migrate the only affected usage (regression-test StringTest UDF) from
org.apache.commons.lang.StringUtils to
org.apache.commons.lang3.StringUtils

**Note: this removes commons-lang 2.x from the BE Java UDF runtime
classpath; legacy user UDFs importing org.apache.commons.lang.* must
migrate to lang3.**
---
 fe/be-java-extensions/java-common/pom.xml                 | 5 -----
 fe/be-java-extensions/preload-extensions/pom.xml          | 5 -----
 fe/pom.xml                                                | 8 --------
 .../src/main/java/org/apache/doris/udf/StringTest.java    | 2 +-
 4 files changed, 1 insertion(+), 19 deletions(-)

diff --git a/fe/be-java-extensions/java-common/pom.xml b/fe/be-java-extensions/java-common/pom.xml
index 883615bcf78600..d09224bf6b68a8 100644
--- a/fe/be-java-extensions/java-common/pom.xml
+++ b/fe/be-java-extensions/java-common/pom.xml
@@ -95,11 +95,6 @@ under the License.
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
         </dependency>
-        <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-            <version>${commons-lang.version}</version>
-        </dependency>
         <!-- these dependencies are for iceberg-aws -->
         <dependency>
             <groupId>software.amazon.awssdk</groupId>
diff --git a/fe/be-java-extensions/preload-extensions/pom.xml b/fe/be-java-extensions/preload-extensions/pom.xml
index c7d22571797fa8..ecdecf236a3ace 100644
--- a/fe/be-java-extensions/preload-extensions/pom.xml
+++ b/fe/be-java-extensions/preload-extensions/pom.xml
@@ -147,11 +147,6 @@ under the License.
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
         </dependency>
-        <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-            <version>${commons-lang.version}</version>
-        </dependency>
         <!-- For BE CosN Access -->
         <dependency>
             <groupId>com.qcloud.cos</groupId>
diff --git a/fe/pom.xml b/fe/pom.xml
index 0b7d9f575ff135..972838dc3ce855 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -257,7 +257,6 @@ under the License.
         <commons-filerupload.version>1.6.0</commons-filerupload.version>
         <commons-configuration2.version>2.11.0</commons-configuration2.version>
         <commons-codec.version>1.13</commons-codec.version>
-        <commons-lang.version>2.6</commons-lang.version>
         <commons-lang3.version>3.19.0</commons-lang3.version>
         <commons-pool2.version>2.2</commons-pool2.version>
         <commons-pool.version>1.5.1</commons-pool.version>
@@ -801,13 +800,6 @@ under the License.
                 <artifactId>commons-codec</artifactId>
                 <version>${commons-codec.version}</version>
             </dependency>
-            <!-- https://mvnrepository.com/artifact/commons-lang/commons-lang -->
-            <!-- upgrade commons-lang from 2.4 to 2.6 to fix incompatibility of with versioning scheme of Java 9 and later -->
-            <dependency>
-                <groupId>commons-lang</groupId>
-                <artifactId>commons-lang</artifactId>
-                <version>${commons-lang.version}</version>
-            </dependency>
             <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-lang3 -->
             <dependency>
                 <groupId>org.apache.commons</groupId>
diff --git a/regression-test/java-udf-src/src/main/java/org/apache/doris/udf/StringTest.java b/regression-test/java-udf-src/src/main/java/org/apache/doris/udf/StringTest.java
index 822c484c70660e..fc8e6803b703cc 100644
--- a/regression-test/java-udf-src/src/main/java/org/apache/doris/udf/StringTest.java
+++ b/regression-test/java-udf-src/src/main/java/org/apache/doris/udf/StringTest.java
@@ -17,7 +17,7 @@
 
 package org.apache.doris.udf;
 
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.hadoop.hive.ql.exec.UDF;
 
 public class StringTest extends UDF {

From 0ff99d5b4c8903ff9469f493c819d5cbe05fcb6d Mon Sep 17 00:00:00 2001
From: Calvin Kirs <guoqiang@selectdb.com>
Date: Mon, 15 Jun 2026 11:52:29 +0800
Subject: [PATCH 3/3] [chore](dep)Upgrade dependencies (#64208)

Upgrade FE dependency versions for dependency scan findings:

- Exclude transitive dependencies from `hive-exec` in `fe/hive-udf`:
  - `org.apache.calcite:calcite-core`
  - `org.apache.calcite:calcite-druid`
  - `log4j:log4j`
- Upgrade Netty managed version from `4.1.132.Final` to `4.2.15.Final`,
covering Netty BOM-managed jars such as `netty-codec-memcache`,
`netty-codec-mqtt`, and `netty-transport`.
- Upgrade Azure SDK BOM from `1.3.4` to `1.3.7`, updating:
  - `azure-storage-blob` `12.33.1` -> `12.34.0`
  - `azure-core` `1.57.1` -> `1.58.0`
  - `azure-core-http-netty` `1.16.3` -> `1.16.4`
  - `azure-storage-common` `12.32.1` -> `12.33.0`
  - `azure-storage-internal-avro` `12.18.1` -> `12.19.0`
  - `azure-identity` `1.18.2` -> `1.18.3`
- Override Azure transitive dependencies:
  - `msal4j` `1.23.1` -> `1.25.0`
  - `azure-keyvault-core` `1.0.0` -> `1.2.6`
- Manage `commons-net:commons-net` to `3.13.0`, replacing older
transitive resolutions such as `3.6` from the Hive/Hadoop path and
`3.9.0` from Hadoop common.
---
 fe/hive-udf/pom.xml | 14 ++++++++++++++
 fe/pom.xml          | 28 ++++++++++++++++++++++++----
 2 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/fe/hive-udf/pom.xml b/fe/hive-udf/pom.xml
index 7d48ac5c0ca30f..a30a2a5ac6fed1 100644
--- a/fe/hive-udf/pom.xml
+++ b/fe/hive-udf/pom.xml
@@ -53,6 +53,20 @@ under the License.
             <artifactId>hive-exec</artifactId>
             <version>${hive.version}</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.calcite</groupId>
+                    <artifactId>calcite-core</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.calcite</groupId>
+                    <artifactId>calcite-druid</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>
diff --git a/fe/pom.xml b/fe/pom.xml
index 972838dc3ce855..e1267cc64bd50f 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -258,6 +258,7 @@ under the License.
         <commons-configuration2.version>2.11.0</commons-configuration2.version>
         <commons-codec.version>1.13</commons-codec.version>
         <commons-lang3.version>3.19.0</commons-lang3.version>
+        <commons-net.version>3.13.0</commons-net.version>
         <commons-pool2.version>2.2</commons-pool2.version>
         <commons-pool.version>1.5.1</commons-pool.version>
         <commons-text.version>1.10.0</commons-text.version>
@@ -282,9 +283,8 @@ under the License.
         <mqtt.version>1.2.5</mqtt.version>
         <slf4j.version>2.0.17</slf4j.version>
         <metrics-core.version>4.0.2</metrics-core.version>
-        <!--Netty 4.1.94 is not compatible with arrow flight.-->
-        <!--Need to ensure that the version is the same as in arrow/java/pom.xml or compatible with it.-->
-        <netty-all.version>4.1.130.Final</netty-all.version>
+        <!-- Keep Netty compatible with Arrow Flight SQL 19 and other transitive Netty users. -->
+        <netty-all.version>4.2.15.Final</netty-all.version>
         <!--The dependence of transitive dependence cannot be ruled out, only Saving the nation through twisted ways.-->
         <netty-3-test.version>3.10.6.Final</netty-3-test.version>
         <objenesis.version>2.1</objenesis.version>
@@ -394,8 +394,10 @@ under the License.
         <jakarta.annotation-api.version>2.1.1</jakarta.annotation-api.version>
         <asm.version>9.4</asm.version>
         <airlift.concurrent.version>202</airlift.concurrent.version>
-        <azure.sdk.version>1.3.4</azure.sdk.version>
+        <azure.sdk.version>1.3.7</azure.sdk.version>
         <azure.sdk.batch.version>12.22.0</azure.sdk.batch.version>
+        <msal4j.version>1.25.0</msal4j.version>
+        <azure.keyvault.core.version>1.2.6</azure.keyvault.core.version>
         <semver4j.version>5.3.0</semver4j.version>
         <aliyun-sdk-oss.version>3.15.0</aliyun-sdk-oss.version>
         <!--Fixes the regression described in https://github.com/aws/aws-sdk-java-v2/issues/5805 that forced us to downgrade aws-s3 to version 2.29.x.-->
@@ -806,6 +808,12 @@ under the License.
                 <artifactId>commons-lang3</artifactId>
                 <version>${commons-lang3.version}</version>
             </dependency>
+            <!-- Pulled in by hive-exec -> hadoop-yarn-registry and hadoop-common. -->
+            <dependency>
+                <groupId>commons-net</groupId>
+                <artifactId>commons-net</artifactId>
+                <version>${commons-net.version}</version>
+            </dependency>
             <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-math3 -->
             <dependency>
                 <groupId>org.apache.commons</groupId>
@@ -1789,6 +1797,18 @@ under the License.
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Pulled in by azure-identity and msal4j-persistence-extension. -->
+            <dependency>
+                <groupId>com.microsoft.azure</groupId>
+                <artifactId>msal4j</artifactId>
+                <version>${msal4j.version}</version>
+            </dependency>
+            <!-- Pulled in by hadoop-azure -> azure-storage. -->
+            <dependency>
+                <groupId>com.microsoft.azure</groupId>
+                <artifactId>azure-keyvault-core</artifactId>
+                <version>${azure.keyvault.core.version}</version>
+            </dependency>
             <!-- tencent COS -->
             <dependency>
                 <groupId>com.qcloud</groupId>