[SPARK-58755][BUILD] Upgrade 6 third-party dependencies to fix 29 sec…

[anoopamS]

…urity vulnerabilities

Upgrades:

• libthrift: 0.16.0 -> 0.24.0 (18 CVEs)
• Jackson (fasterxml): 2.22.0 -> 2.22.1 (4 CVEs)
• Log4j: 2.26.0 -> 2.26.1 (1 CVE)
• Janino: 3.1.9 -> 3.1.12 (1 CVE)
• Apache Ivy: 2.5.3 -> 2.6.0 (1 CVE)
• scalapb-runtime: 0.11.17 -> 0.11.20 (4 CVEs)

All upgrades are minor/patch versions maintaining backward compatibility. Full distribution build passes with no compile errors. No user-facing API changes.

Closes #XXXXX

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

Was this patch authored or co-authored using generative AI tooling?

[LuciferYang]

@anoopamS Thanks for your work.

1. You need to permit the execution of GHA workflows.
2. Each dependency upgrade should be submitted as a separate PR, unless there are coupling dependencies between them. This allows clean reverts when issues are identified.
3. Per the rules, any third-party library upgrade must wait at least one week after its official release before we bump its version.
4. There is already an existing PR for upgrading Janino: [SPARK-58134][BUILD] Upgrade janino to 3.1.12 #57266

[anoopamS]

@ LuciferYang Thanks for your inputs. Let me abandon this single commit and will push the separate commit for each 3PP. But, I have one doubt. Can I push all the separate commit on single JIRA or you want me create separate JIRA too for each 3PP? Thanks! From: YangJie ***@***.***> Sent: 13 August 2026 12:07 To: apache/spark ***@***.***> Cc: Anoopam Sharma ***@***.***>; Mention ***@***.***> Subject: Re: [apache/spark] [SPARK-58755][BUILD] Upgrade 6 third-party dependencies to fix 29 sec… (PR #57982) You don't often get email from ***@***.*** Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> [Image removed by sender.]LuciferYang left a comment (apache/spark#57982)<#57982 (comment)> Image: image (view on web)<https://github.com/user-attachments/assets/0d256711-4a48-4cb0-a686-57d425fb0aa2> @anoopamS<https://github.com/anoopamS> Thanks for your work. 1. You need to permit the execution of GHA workflows. 2. Each dependency upgrade should be submitted as a separate PR, unless there are coupling dependencies between them. This allows clean reverts when issues are identified. 3. Per the rules, any third-party library upgrade must wait at least one week after its official release before we bump its version. 4. There is already an existing PR for upgrading Janino: #57266<#57266> — Reply to this email directly, view it on GitHub<#57982?email_source=notifications&email_token=BO3J4IFUSE52CJHFBDTXR335JVOZ5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRXGY4DQMJYGU42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5276881859>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BO3J4IFDXDFOAH7J77OMJ535JVOZ5AVCNFSNUABEKJSXA33TNF2G64TZHMYTOMJWGU3DKOB3JFZXG5LFHM2TCMZYGAZDIMZQGSQXMAQ>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/BO3J4IBDZNRL75AGLW4RVML5JVOZ5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRXGY4DQMJYGU42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android<https://github.com/notifications/mobile/android/BO3J4IEHCLLF4BZU3LCVBHD5JVOZ5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRXGY4DQMJYGU42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[LuciferYang]

One Jira ticket per dependency upgrade.

[uros-b]

+1 with @LuciferYang's comment above, e.g. #58116 for Jackson

[anoopamS]

Closing this combined PR. Will re-submit as individual PRs per reviewer feedback (one per dependency upgrade).