You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2024/02/27 06:20:01 UTC
(pulsar) 02/02: [improve][ci] Exclude jose4j to avoid CVE-2023-31582 (#21791)
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-3.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 860f085ceaebe64fe5de3a6dfb90749709635207
Author: Jiwei Guo <te...@apache.org>
AuthorDate: Wed Dec 27 10:07:49 2023 +0800
[improve][ci] Exclude jose4j to avoid CVE-2023-31582 (#21791)
(cherry picked from commit d9c55b4f5c70fa13185fdf0290d4513b0380f216)
---
pom.xml | 4 ++++
pulsar-io/debezium/core/pom.xml | 4 ++++
pulsar-io/kafka-connect-adaptor/pom.xml | 22 ++++++++++++++++++++++
pulsar-io/kafka/pom.xml | 6 ++++++
pulsar-io/solr/pom.xml | 6 ++++++
5 files changed, 42 insertions(+)
diff --git a/pom.xml b/pom.xml
index 6e4b31aa289..122b551d0e8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -550,6 +550,10 @@ flexible messaging model and an intuitive client API.</description>
<groupId>com.squareup.okio</groupId>
<artifactId>okio</artifactId>
</exclusion>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
</exclusions>
</dependency>
diff --git a/pulsar-io/debezium/core/pom.xml b/pulsar-io/debezium/core/pom.xml
index 5e08eb42b17..b358ef2e9f0 100644
--- a/pulsar-io/debezium/core/pom.xml
+++ b/pulsar-io/debezium/core/pom.xml
@@ -71,6 +71,10 @@
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-log4j-appender</artifactId>
</exclusion>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
</exclusions>
</dependency>
diff --git a/pulsar-io/kafka-connect-adaptor/pom.xml b/pulsar-io/kafka-connect-adaptor/pom.xml
index 51cd57cb13a..e820b17568f 100644
--- a/pulsar-io/kafka-connect-adaptor/pom.xml
+++ b/pulsar-io/kafka-connect-adaptor/pom.xml
@@ -73,6 +73,10 @@
<groupId>org.eclipse.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
</exclusions>
</dependency>
@@ -80,12 +84,24 @@
<groupId>org.apache.kafka</groupId>
<artifactId>connect-json</artifactId>
<version>${kafka-client.version}</version>
+ <exclusions>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>connect-api</artifactId>
<version>${kafka-client.version}</version>
+ <exclusions>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
+ </exclusions>
</dependency>
<!-- pulsar-client is only needed for MessageId conversion (for seeking), commons-lang3 and Netty buffer manipulation -->
@@ -136,6 +152,12 @@
<artifactId>connect-file</artifactId>
<version>${kafka-client.version}</version>
<scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
diff --git a/pulsar-io/kafka/pom.xml b/pulsar-io/kafka/pom.xml
index adbbce1348e..290e03c7b34 100644
--- a/pulsar-io/kafka/pom.xml
+++ b/pulsar-io/kafka/pom.xml
@@ -84,6 +84,12 @@
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-clients</artifactId>
<version>${kafka-client.version}</version>
+ <exclusions>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
diff --git a/pulsar-io/solr/pom.xml b/pulsar-io/solr/pom.xml
index 4ba68befb03..9d2f7410a92 100644
--- a/pulsar-io/solr/pom.xml
+++ b/pulsar-io/solr/pom.xml
@@ -65,6 +65,12 @@
<groupId>org.apache.solr</groupId>
<artifactId>solr-core</artifactId>
<version>${solr.version}</version>
+ <exclusions>
+ <exclusion>
+ <artifactId>jose4j</artifactId>
+ <groupId>org.bitbucket.b_c</groupId>
+ </exclusion>
+ </exclusions>
<scope>test</scope>
</dependency>
<dependency>