Re: [I] Upgrade Guava in presto/trino bundles [hudi]

["nsivabalan (via GitHub)" <gi...@apache.org>]

nsivabalan commented on issue #15506:
URL: https://github.com/apache/hudi/issues/15506#issuecomment-4795437797

   Triage: This appears to be no longer applicable in current master. The `hudi-presto-bundle` and `hudi-trino-bundle` shade configurations use a strict `<artifactSet><includes>` allow-list, and `com.google.guava` is **not** in either bundle's include list — so guava classes are not packaged into the shaded jars. The `hudi-trino-bundle` additionally excludes guava transitively from `hudi-client-common`. At runtime, guava is provided by the Presto/Trino host, so CVE-2018-10237 is not exposed via the Hudi bundles themselves. Closing as fixed/not-applicable seems reasonable — please reopen if you've observed guava classes actually shipping inside `hudi-presto-bundle-*.jar` or `hudi-trino-bundle-*.jar` (e.g., via `jar tf | grep com/google/common`).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org