Apache Pinot Releases

GET https://watchchangelog.com/api/v1/entries?source=apache-pinot.releases

{
  "source": "apache-pinot.releases",
  "vendor": "Apache",
  "id": "tag:github.com,2008:Repository/19961085/release-1.5.1",
  "published_at": "2026-06-30T22:21:00.000Z",
  "title": "Apache Pinot 1.5.1",
  "url": "https://github.com/apache/pinot/releases/tag/release-1.5.1",
  "summary": "Apache Pinot 1.5.1 Apache Pinot 1.5.1 is a security patch release based on 1.5.0. It contains only dependency updates and dependency-exclusion changes to resolve reported CVEs — no functional, API, configuration, or wire-format changes . A vulnerability scan of the 1.5.1 binary distribution reports 0 critical and 0 high findings. This addresses the CVEs reported in #18593 , plus additional Jetty, BouncyCastle, and commons-configuration2 findings surfaced during release verification. Security fixes Dependency 1.5.0 → 1.5.1 CVEs addressed Netty ( netty-bom ) 4.1.122.Final → 4.1.134.Final CVE-2025-55163 , CVE-2025-59419 , CVE-2026-33870 , CVE-2026-33871 , CVE-2026-42579 , CVE-2026-42583 , CVE-2026-42584 , CVE-2026-42587 Apache Log4j Core 2.25.3 → 2.26.0 CVE-2026-34478 , CVE-2026-34479 , CVE-2026-34480 , CVE-2026-34481 async-http-client 3.0.7 → 3.0.10 CVE-2026-45300 Apache HttpClient 5 5.6 → 5.6.1 CVE-2026-40542 Apache Pulsar (bundles BouncyCastle) 4.0.9 → 4.0.10 (bcprov/bcpkix/bcutil → 1.84 ) CVE-2026-5598 , CVE-2026-0636 , CVE-2026-5588 commons-configuration2 2.13.0 → 2.15.0 CVE-2026-45205 CVE-2026-2332 (Jetty request smuggling) The only Jetty in Pinot's distribution was Hadoop's embedded HttpServer2 , which Pinot never starts. As of 1.5.1 it is excluded from the Hadoop dependencies and stripped from the shaded jars ( #18659 ), so Jetty no longer ships in the distribution at all. (Jetty 9.4.x itself is end-of-life with no available patch; removing the unused artifact is the resolution.) Upgrade notes Drop-in security update for 1.5.0 — no behavioral changes. Full Changelog : release-1.5.0...release-1.5.1",
  "tags": [
    "Apache",
    "apache-pinot.releases",
    "database",
    "olap",
    "realtime"
  ]
}