You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@celeborn.apache.org by "dev-lpq (via GitHub)" <gi...@apache.org> on 2023/12/19 09:47:19 UTC
[PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
dev-lpq opened a new pull request, #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169
<!--
Thanks for sending a pull request! Here are some tips for you:
- Make sure the PR title start w/ a JIRA ticket, e.g. '[CELEBORN-XXXX] Your PR title ...'.
- Be sure to keep the PR description updated to reflect all changes.
- Please write your PR title to summarize what this PR proposes.
- If possible, provide a concise example to reproduce the issue for a faster review.
-->
### What changes were proposed in this pull request?
Update avro version from 1.7.7 to 1.11.3 reducing direct CVE vulnerabilities.
### Why are the changes needed?
The netty version has the follow CVE vulnerabilities, see
https://scout.docker.com/vulnerabilities/id/CVE-2023-39410
### Does this PR introduce _any_ user-facing change?
No any user-facing change
### How was this patch tested?
./build/make-distribution.sh to package and run test on the local.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "SteNicholas (via GitHub)" <gi...@apache.org>.
SteNicholas commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1899761120
@dev-lpq, any update for sbt?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "dev-lpq (via GitHub)" <gi...@apache.org>.
dev-lpq commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1862505624
@pan3793, Yes, Celeborn does not depend on avro jar. The avro jar should not be compiled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "SteNicholas (via GitHub)" <gi...@apache.org>.
SteNicholas commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1925566373
@dev-lpq, I will close this pull request. When you have any updates, you could reopen this pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "cfmcgrady (via GitHub)" <gi...@apache.org>.
cfmcgrady commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1863767407
> the dep-check list should reflect the binary shipped dep list, not the compile dep list
Hi, @dev-lpq are you interested in completing this task?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1862461533
## [Codecov](https://app.codecov.io/gh/apache/incubator-celeborn/pull/2169?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Comparison is base [(`4dacf72`)](https://app.codecov.io/gh/apache/incubator-celeborn/commit/4dacf72a6d662dd6b2bf6c60669a8baad0f1566d?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) 47.26% compared to head [(`f3a6e22`)](https://app.codecov.io/gh/apache/incubator-celeborn/pull/2169?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) 47.12%.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #2169 +/- ##
==========================================
- Coverage 47.26% 47.12% -0.13%
==========================================
Files 185 185
Lines 11673 11673
Branches 1039 1039
==========================================
- Hits 5516 5500 -16
- Misses 5795 5808 +13
- Partials 362 365 +3
```
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/incubator-celeborn/pull/2169?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1884396530
This PR is stale because it has been open 20 days with no activity. Remove stale label or comment or this will be closed in 10 days.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "dev-lpq (via GitHub)" <gi...@apache.org>.
dev-lpq commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1863776583
@cfmcgrady. Yes, I'm interested.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "pan3793 (via GitHub)" <gi...@apache.org>.
pan3793 commented on PR #2169:
URL: https://github.com/apache/incubator-celeborn/pull/2169#issuecomment-1862497805
it's the transitive dep of Hadoop, Celeborn actually does not ship it in the MR client jar.
@cfmcgrady I remember I have raised such issue a few months ago, the dep-check list should reflect the binary shipped dep list, not the compile dep list
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3 [incubator-celeborn]
Posted by "SteNicholas (via GitHub)" <gi...@apache.org>.
SteNicholas closed pull request #2169: [CELEBORN-1183] Upgrade the avro version from 1.7.7 to 1.11.3
URL: https://github.com/apache/incubator-celeborn/pull/2169
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@celeborn.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org