Merge remote-tracking branch origin/rel-3.46.0

Author: h2o-ops

Changes.md

@@ -2,6 +2,31 @@
 
 ## H2O
 
+### 3.46.0.11 - 5/21/2026
+
+Download at: <a href='http://h2o-release.s3.amazonaws.com/h2o/rel-3.46.0/11/index.html'>http://h2o-release.s3.amazonaws.com/h2o/rel-3.46.0/11/index.html</a>
+
+#### Bug
+- [[#16842]](https://github.com/h2oai/h2o-3/issues/16842) – Fixed GLM standard error calculation bug.
+- [[#16662]](https://github.com/h2oai/h2o-3/issues/16662) – Fixed reproducible nondeterminism in Grid+GAM grid search.
+- [[#16566]](https://github.com/h2oai/h2o-3/issues/16566) – Fixed CI test flakes (timeout rule, AdaBoost ignore, orc scope).
+- [[#16757]](https://github.com/h2oai/h2o-3/issues/16757) – Fixed `top_n_features` in `shap_summary_plot` in R.
+- [[#16758]](https://github.com/h2oai/h2o-3/issues/16758) – Fixed `h2o.shap_summary_plot()` in R.
+- [[#16798]](https://github.com/h2oai/h2o-3/issues/16798) – Fixed inconsistencies in Python type-hints.
+
+#### New Feature
+- [[#16676]](https://github.com/h2oai/h2o-3/issues/16676) – Added support for removing offset effects in GLM.
+- [[#16786]](https://github.com/h2oai/h2o-3/issues/16786) – Added MOJO support for GLM remove offset effects.
+
+#### Docs
+- [[#16809]](https://github.com/h2oai/h2o-3/issues/16809) – Reconciled Grid Search docs with parameter and algorithm pages.
+- [[#16804]](https://github.com/h2oai/h2o-3/issues/16804) – Added `h2o.make_derived_glm_model` to R `_pkgdown.yml`.
+
+#### Security
+- [[#16844]](https://github.com/h2oai/h2o-3/issues/16844) – Bumped log4j to 2.25.4 to fix CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, and CVE-2026-34480.
+- [[#16847]](https://github.com/h2oai/h2o-3/issues/16847) – Upgraded mina-core to 2.2.6 to fix CVE-2026-41409.
+- [[#16852]](https://github.com/h2oai/h2o-3/issues/16852) – Upgraded mina-core to 2.2.7 to fix CVE-2026-42778 and CVE-2026-42779.
+
 ### 3.46.0.10 - 3/12/2026
 
 Download at: <a href='http://h2o-release.s3.amazonaws.com/h2o/rel-3.46.0/10/index.html'>http://h2o-release.s3.amazonaws.com/h2o/rel-3.46.0/10/index.html</a>

SECURITY.md

@@ -8,12 +8,14 @@ If the issue is confirmed, we will release a patch as soon as possible depending
 ## Known Vulnerabilities
 We located these vulnerabilites from our security scans. The following list shows the vulnerabilities and the libraries they were found in:
 
-Total: 4 (UNKNOWN: 0, LOW: 2, MEDIUM: 2, HIGH: 0, CRITICAL: 0)
+Total: 6 (UNKNOWN: 0, LOW: 2, MEDIUM: 3, HIGH: 1, CRITICAL: 0)
 
 | Library                         | Vulnerability    | Severity | Installed Version | Fixed Version | Title | Mitigation Status |
 |---------------------------------|----------------|---------|-----------------|---------------|-------|-------------------|
+| org.eclipse.jetty:jetty-http    | CVE-2026-2332  | HIGH    | 9.4.57.v20241219| 12.0.33, 12.1.7 | HTTP request smuggling via chunked extension quoting [Link](https://avd.aquasec.com/nvd/cve-2026-2332) | Jetty will be upgraded in a future release. |
 | commons-lang:commons-lang       | CVE-2025-48924 | MEDIUM  | 2.6             |               | Uncontrolled Recursion vulnerability in `ClassUtils.getClass()` [Link](https://avd.aquasec.com/nvd/cve-2025-48924) | Not affected. H2O does not use `ClassUtils` anywhere in the codebase. H2O only uses safe utility methods from this library (e.g., `ArrayUtils`, `StringUtils.join`, `StringUtils.repeat`). |
 | org.eclipse.jetty:jetty-http    | CVE-2024-6763  | MEDIUM  | 9.4.57.v20241219| 12.0.12       | Jetty URI parsing of invalid authority [Link](https://avd.aquasec.com/nvd/cve-2024-6763) | Not affected. The vulnerability only affects applications that use `HttpURI` directly as a utility for URI validation. H2O does not use `HttpURI` in application code; only Jetty's own internal `Response.encodeURL()` references it, which the [Jetty advisory](https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh) confirms is not vulnerable. |
+| org.apache.commons:commons-configuration2 | CVE-2026-45205 | MEDIUM | 2.10.1 | 2.15.0 | Uncontrolled Recursion vulnerability in Apache Commons Configuration [Link](https://avd.aquasec.com/nvd/cve-2026-45205) | Will be addressed in the 3.46.0.11-2 docker image. |
 | org.apache.hadoop:hadoop-common | CVE-2024-23454 | LOW     | 3.3.6           | 3.4.0         | Apache Hadoop: Temporary File Local Information Disclosure [Link](https://avd.aquasec.com/nvd/cve-2024-23454) | Not affected. The vulnerability involves Hadoop's `FileUtil.createTempFile()` creating temporary files with world-readable permissions (0666). H2O does not use Hadoop's `FileUtil` for temporary file creation. All temp file operations use Java's standard `File.createTempFile()`, and credential/keytab files are written via Java's `FileOutputStream` directly. |
 | org.eclipse.jetty:jetty-http    | CVE-2025-11143 | LOW     | 9.4.57.v20241219| 12.0.31, 12.1.5 | Security bypass due to different URI parsing between Jetty HttpURI and java.net.URI [Link](https://avd.aquasec.com/nvd/cve-2025-11143) | Not affected. The vulnerability requires an application to use both Jetty's `HttpURI` and Java's `java.net.URI` for security decisions, creating a parsing inconsistency bypass. H2O only uses Jetty's servlet API (`getServletPath()`) for URI extraction, does not use `HttpURI` or `java.net.URI` for security-critical comparisons, and its authentication constraint uses a blanket wildcard `/*` path that applies to all requests regardless of URI parsing. |