From 8c740b05dcc805ed2844d8a86eb282063b97c9a8 Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Mon, 31 Aug 2026 11:57:46 +0300
Subject: [PATCH] [fix][sec][branch-4.x] Upgrade Thrift to 0.24.0

---
 distribution/server/src/assemble/LICENSE.bin.txt | 2 +-
 pom.xml                                          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 3bafc226ade3f..b4fb3ff5889b4 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -433,7 +433,7 @@ The Apache Software License, Version 2.0
  * SnakeYaml -- org.yaml-snakeyaml-2.0.jar
  * RocksDB - org.rocksdb-rocksdbjni-7.9.2.jar
  * Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.45.0.jar
- * Apache Thrift - org.apache.thrift-libthrift-0.23.0.jar
+ * Apache Thrift - org.apache.thrift-libthrift-0.24.0.jar
  * OkHttp3
      - com.squareup.okhttp3-logging-interceptor-5.3.2.jar
      - com.squareup.okhttp3-okhttp-5.3.2.jar
diff --git a/pom.xml b/pom.xml
index d5726190f96bc..713e5c567081b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -303,7 +303,7 @@ flexible messaging model and an intuitive client API.</description>
     <ant.version>1.10.12</ant.version>
     <seancfoley.ipaddress.version>5.5.0</seancfoley.ipaddress.version>
     <disruptor.version>3.4.3</disruptor.version>
-    <thrift.version>0.23.0</thrift.version>
+    <thrift.version>0.24.0</thrift.version>
 
     <!-- zstd-jni is only used for testcase,
     the core logic is switched to java implementation of zstd in org.apache.commons:commons-compress -->
@@ -1352,7 +1352,7 @@ flexible messaging model and an intuitive client API.</description>
         </exclusions>
       </dependency>
       <!-- libthrift is a transitive dependency of distributedlog-core.
-      libthrift 0.23.0 upgraded to jakarta.* and HttpComponents 5 deps for its HTTP/servlet
+      libthrift 0.23.0 and later upgraded to jakarta.* and HttpComponents 5 deps for its HTTP/servlet
       transports, which distributedlog-core does not use (only TJSON/TMemory serialization is needed). !-->
       <dependency>
         <groupId>org.apache.thrift</groupId>