You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-issues@hadoop.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2023/08/01 10:49:00 UTC
[jira] [Commented] (YARN-11535) Snakeyaml should be excluded from jackson-dataformat-yaml-2.12.7 as it may cause transitive dependency issue.
[ https://issues.apache.org/jira/browse/YARN-11535?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17749618#comment-17749618 ]
ASF GitHub Bot commented on YARN-11535:
---------------------------------------
tomicooler commented on code in PR #5884:
URL: https://github.com/apache/hadoop/pull/5884#discussion_r1280451636
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/pom.xml:
##########
@@ -333,6 +333,16 @@
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>org.yaml</groupId>
+ <artifactId>snakeyaml</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.yaml</groupId>
+ <artifactId>snakeyaml</artifactId>
Review Comment:
I think instead of this exclusion, we should update `com.fasterxml.jackson.dataformat` to 2.15.2 version which uses snakeyaml 2.0.
https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.15.2
Can we try that option?
> Snakeyaml should be excluded from jackson-dataformat-yaml-2.12.7 as it may cause transitive dependency issue.
> -------------------------------------------------------------------------------------------------------------
>
> Key: YARN-11535
> URL: https://issues.apache.org/jira/browse/YARN-11535
> Project: Hadoop YARN
> Issue Type: Task
> Components: build, yarn
> Affects Versions: 3.4.0
> Reporter: Susheel Gupta
> Assignee: Susheel Gupta
> Priority: Major
> Labels: pull-request-available
>
> Hadoop-project uses [snakeyaml.version-2.0|https://github.com/apache/hadoop/blame/trunk/hadoop-project/pom.xml#L198] and [jackson-dataformat-yaml-2.12.7|https://github.com/apache/hadoop/blob/trunk/hadoop-project/pom.xml#L72].
> But internally jackson-dataformat-yaml-2.12.7 uses compile dependency [snakeyaml.version-1.27|https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.12.7] .This may cause a transitive dependency issue in other services using hadoop jar having jackson-dataformat-yaml-2.12.7 as jackson-dataformat-yaml-2.12.7 will use nearest dependency available of snakeyaml i.e 1.27 and ignore the version of snakeyaml-2.0 from hadoop-project.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org