[SPARK-58134][BUILD] Upgrade janino to 3.1.12

[zml1206]

What changes were proposed in this pull request?

This pr upgrade janino from 3.1.9 to 3.1.12.

Why are the changes needed?

Janino 3.1.9 and earlier are affected by CVE-2023-33546, a disputed DoS issue where deeply nested user-supplied input can trigger a StackOverflowError in Janino parser APIs such as ExpressionEvaluator.guessParameterNames. Although Spark SQL codegen uses Janino through ClassBodyEvaluator rather than that specific API, upgrading removes the vulnerable dependency version reported by dependency scanners and picks up Janino's parser/codegen robustness fixes.

Does this PR introduce any user-facing change?

No.

How was this patch tested?

Pass the CIs.

Was this patch authored or co-authored using generative AI tooling?

No.

[LuciferYang]

cc @cloud-fan

[cloud-fan]

do we have a summary of the release notes between 3.1.9 and 3.1.12? janino is a sensitive and critical dependency to Spark SQL

[zml1206]

do we have a summary of the release notes between 3.1.9 and 3.1.12? janino is a sensitive and critical dependency to Spark SQL

Yes. Janino provides an official change log covering versions 3.1.10 through 3.1.12.
The releases include improved handling of StackOverflowError, fixes for type conversion, method resolution, static inner-class compilation, classpath handling, and compiler discovery via ServiceLoader.
Janino 3.1.11 also lists issue #208, which contains a third-party report of an ArrayIndexOutOfBoundsException while Janino 3.1.9 was compiling Spark-generated code. However, I could not find a corresponding Spark JIRA, Spark regression test, or confirmation from Spark maintainers, so this should not be presented as an officially verified Spark fix.
Given Janino's critical role in Spark SQL runtime code generation, this upgrade should primarily be described as a compiler correctness, robustness, and dependency-security update.

[cloud-fan]

cc @dongjoon-hyun , how far shall we backport? It claims to fix a CVE.

[dongjoon-hyun]

I'm not sure that we need this (as an exception) in old branches. I'd prefer to put this on Spark 5 only according to our recent policy, @cloud-fan . Netty has a ton of CVEs, but we didn't backport at all.

[LuciferYang]

+1 for 5.0.0 only

[LuciferYang]

@zml1206 Please rebase the code. I will merge this PR once the CI passes again.

[zml1206]

@zml1206 Please rebase the code. I will merge this PR once the CI passes again.

Rebased and CI passed. @LuciferYang

[LuciferYang]

Merge Summary:

• merged into master ebd6a69

Posted by merge_spark_pr.py

[LuciferYang]

Thank you @zml1206 and all