[jira] [Commented] (NIFI-4297) Immediately actionable dependency upgrades

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/NIFI-4297?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16176357#comment-16176357 ] 

ASF GitHub Bot commented on NIFI-4297:
--------------------------------------

Github user joewitt commented on the issue:

    https://github.com/apache/nifi/pull/2084
  
    @mcgilman @alopresto the lack of L&N on that is because we're not publishing a bundled artifact for it (like we do with nars).  We're simply putting source up or the binary of our external but then normal dep/maven magic takes over.  So, we're ok as-is and having a cat-b dependency is still fair game.  Once someone pulls in our library (which depends on that stuff) then they would have to consider the EPL implications.  In short, i think we're good here for L&N based on andy's above assessment.


> Immediately actionable dependency upgrades
> ------------------------------------------
>
>                 Key: NIFI-4297
>                 URL: https://issues.apache.org/jira/browse/NIFI-4297
>             Project: Apache NiFi
>          Issue Type: Sub-task
>          Components: Extensions
>    Affects Versions: 1.3.0
>            Reporter: Andy LoPresto
>            Assignee: Andy LoPresto
>              Labels: dependencies, security
>
> The immediately actionable items are:
> * {{org.apache.logging.log4j:log4j-core}} in {{nifi-storm-spout}} 2.1 -> 2.8.2
> * {{org.apache.poi:poi}} in {{nifi-email-processors}} 3.14 -> 3.15
> * {{org.apache.logging.log4j:log4j-core}} in {{nifi-elasticsearch-5-processors}} 2.7 -> 2.8.2
> * {{org.springframework:spring-web}} in {{nifi-jetty}} 4.2.4.RELEASE -> 4.3.10.RELEASE
> * {{org.springframework:spring-web}} in {{nifi-jetty}} 4.2.4.RELEASE -> 4.3.10.RELEASE
> * {{org.apache.derby:derby}} in {{nifi-kite-processors}} 10.11.1.1 -> 10.12.1.1 (already excluded)
> * {{com.fasterxml.jackson.core:jackson-core}} in {{nifi-azure-processors}} 2.6.0 -> 2.8.6
> * {{com.fasterxml.jackson.core:jackson-core}} in {{nifi-expression-language}} 2.6.1 -> 2.8.6
> * {{com.fasterxml.jackson.core:jackson-core}} in {{nifi-standard-utils}} 2.6.2 -> 2.8.6
> * {{com.fasterxml.jackson.core:jackson-core}} in {{nifi-hwx-schema-registry}} 2.7.3 -> 2.8.6
> * {{com.fasterxml.jackson.core:jackson-core}} in {{nifi-solr-processors}} 2.5.4 -> 2.8.6



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)