chore(deps): Bump aircompressor from 0.27 to 2.0.3

[Dilli-Babu-Godari]

Description

Fixes the CVE-2025-67721 which causes unintended data exposure when processing malformed compressed input.

Motivation and Context

Impact

Test Plan

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.
• If adding new dependencies, verified they have an OpenSSF Scorecard score of 5.0 or higher (or obtained explicit TSC approval for lower scores).

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes
* Update aircompressor dependency from 0.27 to version 2.0.2 to fix `CVE-2025-67721 <https://www.cve.org/CVERecord?id=CVE-2025-67721>`_

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Dilli-Babu-Godari / name: Dilli-Babu-Godari (aa376a0)

[imjalpreet]

@Dilli-Babu-Godari, thanks for the fix.

Can you please run some simple tests like creating a table with different compression types(SNAPPY, LZO, LZ4, ZSTD) and file formats(Parquet and ORC) using Hive connector and share the results here?

[steveburnett]

Is there a CVE associated with the Security Change category upgrade?

[imjalpreet]

@steveburnett, yes, this upgrade fixes this CVE: https://www.cve.org/CVERecord?id=CVE-2025-67721

@Dilli-Babu-Godari, please update the PR description and release notes accordingly.

[Dilli-Babu-Godari]

@Dilli-Babu-Godari, thanks for the fix.

Can you please run some simple tests like creating a table with different compression types(SNAPPY, LZO, LZ4, ZSTD) and file formats(Parquet and ORC) using Hive connector and share the results here?

@imjalpreet, I have performed testing with certain decompression formats with data file formats, Here are the results for this,

Results for ORC + compression formats:

Result for Parquet + compression formats:

[steveburnett]

Thanks for the release note update! Formatting nit:

== RELEASE NOTES ==

Security Changes
* Update aircompressor dependency from 0.27 to version 2.0.2 to fix `CVE-2025-67721 <https://www.cve.org/CVERecord?id=CVE-2025-67721>`_

[imjalpreet]

Thanks, @Dilli-Babu-Godari.

[hantangwangd]

Thanks @Dilli-Babu-Godari

[imjalpreet]

@Dilli-Babu-Godari, can you please rebase on master to trigger the renamed tests in CI? Otherwise, we cannot merge the PR.

[Dilli-Babu-Godari]

@Dilli-Babu-Godari, can you please rebase on master to trigger the renamed tests in CI? Otherwise, we cannot merge the PR.

Thanks @imjalpreet. I have triggered and waiting for the checks to complete.

[Joe-Abraham]

LGTM, Thanks @Dilli-Babu-Godari