[GitHub] [spark] bjornjorgensen commented on pull request #42613: [SPARK-44914][BUILD] Upgrade `Apache ivy` from 2.5.1 to 2.5.2

["bjornjorgensen (via GitHub)" <gi...@apache.org>]

bjornjorgensen commented on PR #42613:
URL: https://github.com/apache/spark/pull/42613#issuecomment-1688853526

   Thank you, @dongjoon-hyun 
   
   List of changes since Ivy 2.5.1:
   
   FIX: ivy:retrieve could fail because of a NullPointerException ([IVY-1641](https://issues.apache.org/jira/browse/IVY-1641))
   
   FIX: reading POMs may loose dependencies when multiple Maven dependencies only differ in classifier ([IVY-1642](https://issues.apache.org/jira/browse/IVY-1642))
   
   IMPROVEMENT: Upgrade Apache HttpClient to 4.5.13 ([IVY-1644](https://issues.apache.org/jira/browse/IVY-1644))
   
   FIX: CVE-2022-46751: Apache Ivy Is Vulnerable to XML External Entity Injections
   
   https://ant.apache.org/ivy/history/2.5.2/release-notes.html
   
   Should we try this for 3.5 also? 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org