You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by GitBox <gi...@apache.org> on 2022/10/13 09:16:09 UTC
[GitHub] [flink] MartijnVisser opened a new pull request, #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
MartijnVisser opened a new pull request, #21048:
URL: https://github.com/apache/flink/pull/21048
## What is the purpose of the change
* Upgrade org.apache.commons:commons-lang3 from 3.3.2 to 3.12.0 to avoid being falsely flagged for CVEs CVE-2021-29425 and CVE-2020-15250
## Brief change log
* Update POM file and NOTICE files
## Verifying this change
This change is a trivial rework / code cleanup without any test coverage.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): yes
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] MartijnVisser merged pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
MartijnVisser merged PR #21048:
URL: https://github.com/apache/flink/pull/21048
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] MartijnVisser commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
MartijnVisser commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1298332850
CI run completed in https://dev.azure.com/apache-flink/98463496-1af2-4620-8eab-a2ecc1a2e6fe/_build/results?buildId=42410
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] zentol commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
zentol commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1277600896
I don't understand how these CVEs are related. One if for commons-io, the other for jUnit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] zentol commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
zentol commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1278774839
I haven't seen a test scanner complain about a test dependency of another project. Where was that reported?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] flinkbot commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
flinkbot commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1277303075
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "7ce8f51bbfe58ad4831a51b2af04ff1f45535929",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "7ce8f51bbfe58ad4831a51b2af04ff1f45535929",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 7ce8f51bbfe58ad4831a51b2af04ff1f45535929 UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] syhily commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
syhily commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1297160834
@MartijnVisser Happy to see that Flink will use latest commons-lang3. Pulsar still use 3.11 on broker. We use this only in connector's mock test, so feel free to remove it if you bump the commons-lang3 to 3.12.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] MartijnVisser commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
MartijnVisser commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1290409666
> I haven't seen a test scanner complain about a `test` dependency of another project. Where was that reported?
https://mvnrepository.com/artifact/org.apache.commons/commons-lang3/3.3.2
In the meantime:
> * org.apache.commons.lang3.StringEscapeUtils
Has been replaced with its successor
> * org.apache.commons.lang3.ArrayUtils#add
Has also been replaced
> pulsar should also use this version.
Also done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] MartijnVisser commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
MartijnVisser commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1277692531
> I don't understand how these CVEs are related. One if for commons-io, the other for jUnit.
Both are transitive dependencies of commons-lang3, which gets picked up by scanners. False flags, but still better to avoid.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] MartijnVisser commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
MartijnVisser commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1291020321
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [flink] MartijnVisser commented on pull request #21048: [FLINK-29624][Common][Connector][Filesystem] Upgrade commons-lang3 to 3.12.0
Posted by GitBox <gi...@apache.org>.
MartijnVisser commented on PR #21048:
URL: https://github.com/apache/flink/pull/21048#issuecomment-1291601116
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org