Pin zookeeper in expansion service (#37859)

claudevdm · web-flow · commit 0f6c88e0d4b9 · 2026-03-14T20:56:07.000-04:00
diff --git a/sdks/java/io/expansion-service/build.gradle b/sdks/java/io/expansion-service/build.gradle
@@ -53,6 +53,9 @@ configurations.runtimeClasspath {
   // Pin logback to 1.5.27 to resolve CVE-2026-1225
   resolutionStrategy.force "ch.qos.logback:logback-classic:1.5.27"
   resolutionStrategy.force "ch.qos.logback:logback-core:1.5.27"
+
+  // Pin zookeeper to 3.8.6 to fix CVE in transitive 3.8.4 from hadoop/hbase
+  resolutionStrategy.force 'org.apache.zookeeper:zookeeper:3.8.6'
 }
 
 shadowJar {

Original file line number	Diff line number	Diff line change
`@@ -53,6 +53,9 @@ configurations.runtimeClasspath {`
`53`	`53`	`// Pin logback to 1.5.27 to resolve CVE-2026-1225`
`54`	`54`	`resolutionStrategy.force "ch.qos.logback:logback-classic:1.5.27"`
`55`	`55`	`resolutionStrategy.force "ch.qos.logback:logback-core:1.5.27"`
	`56`	`+`
	`57`	`+ // Pin zookeeper to 3.8.6 to fix CVE in transitive 3.8.4 from hadoop/hbase`
	`58`	`+ resolutionStrategy.force 'org.apache.zookeeper:zookeeper:3.8.6'`
`56`	`59`	`}`
`57`	`60`
`58`	`61`	`shadowJar {`