From bf2c27b7aecf1e8e4557868d93d601ad53440011 Mon Sep 17 00:00:00 2001
From: Steve Loughran <stevel@cloudera.com>
Date: Mon, 16 Mar 2026 17:48:08 +0000
Subject: [PATCH] HADOOP-19841. hadoop-thirdparty: upgrade to avro 1.11.

Upgrade Apache Avro from 1.11.4 to 1.11.5 in hadoop-shaded-avro_1_11

Addresses CVE-2025-33042

Updates LICENSE-binary to reflect the new version.
---
 LICENSE-binary | 2 +-
 pom.xml        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/LICENSE-binary b/LICENSE-binary
index 8e348be..e57ed32 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -210,7 +210,7 @@ com.google.guava:failureaccess:jar:1.0.3
 org.jspecify:jspecify:jar:1.0.0
 com.google.errorprone:error_prone_annotations:jar:2.36.0
 com.google.j2objc:j2objc-annotations:jar:3.0.0
-org.apache.avro:avro:1.11.4
+org.apache.avro:avro:1.11.5
 
 --------------------------------------------------------------------------------
 This product bundles various third-party components under other open source
diff --git a/pom.xml b/pom.xml
index 5e37822..64943fe 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@
     <guava.version>33.4.8-jre</guava.version>
     <!-- previous versions of guava included this, but they've stopped it. We reinsert it to the shaded guava artifact-->
     <checkerframework.version>3.51.1</checkerframework.version>
-    <avro.version>1.11.4</avro.version>
+    <avro.version>1.11.5</avro.version>
 
     <!--
       Transient dependencies which are not bundled but are depended on by those