You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@hive.apache.org by "arorasimran0309 (via GitHub)" <gi...@apache.org> on 2026/07/23 11:48:24 UTC
[PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
arorasimran0309 opened a new pull request, #6635:
URL: https://github.com/apache/hive/pull/6635
### What changes were proposed in this pull request?
Upgrade Jackson to 2.21.5 to resolve CVEs:
[CVE-2026-54515](https://www.cve.org/CVERecord?id=CVE-2026-54515)
[CVE-2026-54514](https://www.cve.org/CVERecord?id=CVE-2026-54514)
[CVE-2026-54513](https://www.cve.org/CVERecord?id=CVE-2026-54513)
[CVE-2026-54512](https://www.cve.org/CVERecord?id=CVE-2026-54512)
### Why are the changes needed?
version upgrade
### Does this PR introduce _any_ user-facing change?
no-->
### How was this patch tested?
<!--
If tests were added, say they were added here. Please make sure to add some test cases that check the changes thoroughly including negative and positive cases if possible.
If it was tested in a way different from regular unit tests, please clarify how you tested step by step, ideally copy and paste-able, so that other reviewers can test and check, and descendants can verify in the future.
If tests were not added, please describe why they were not added and/or why it was difficult to add.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5331630320
Waiting for green test report, seeing flaky test failures unrelated to jackson and are passing locally.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "InvisibleProgrammer (via GitHub)" <gi...@apache.org>.
InvisibleProgrammer commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5281323887
Note: maybe it worth using jackson-bom.
- [jackson-bom](https://github.com/FasterXML/jackson-bom)
- [what is a maven bom](https://reflectoring.io/maven-bom/)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "InvisibleProgrammer (via GitHub)" <gi...@apache.org>.
InvisibleProgrammer commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5266244601
One note about the CVE mentioned [before](https://github.com/advisories/GHSA-72hv-8253-57qq): It seems the current version that Hive uses actually covers the CVE itself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5323658039
> > About using jackson-bom, ...
>
> You are right, I missed it. Thank you.
>
> > ```
> > As for com.fasterxml.jackson.core:jackson-annotations, version number 2.21 is expected. It seems that is jackson versioning scheme and jackson-annotations uses minor version. As mentioned in jackson-bom:2.21.5:
> > ```
>
> and
>
> > The jackson-dependencies: 2.12.7.1 from hadoop-common:3.4.2 in storage-api has scope ':provided' , which implies its not included in the final package (as seen above).
>
> I'm not sure if I fully get it: Storage-API uses hadoop-common and it still uses an old version of jackson-databind:
>
> ```
> [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:provided
> [INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:provided
> ```
>
> Provided means the artifact itself won't contain the given dependency but still, Hive will expects those versions - just receives it from a dependency. Is it anything against just excluding the old version here so that Hive won't requires the old version runtime?
@InvisibleProgrammer You're right to question this. I have now added 'jackson-bom:2.21.5' to **storage-api's** dependencyManagement (similar to standalone-metastore). This ensures storage-api compile with Jackson 2.21.5 instead of 2.12.7.1 from hadoop-common. PFA the final dependency tree:
[jackson_st-api.txt](https://github.com/user-attachments/files/31164996/jackson_st-api.txt)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "InvisibleProgrammer (via GitHub)" <gi...@apache.org>.
InvisibleProgrammer commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5240071795
I just found this PR because of this CVE: https://github.com/advisories/GHSA-72hv-8253-57qq
It seems the target version fixes the problem.
I see no activity on the PR for two weeks.
@arorasimran0309 , is it an abandoned PR and free to pick up?
If no, could you please check the dependency tree as well to handle the transitive dependency issues, if any?
Thanks,
Zsolt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5266333329
> One note about the CVE mentioned [before](https://github.com/advisories/GHSA-72hv-8253-57qq): It seems the current version that Hive uses actually covers the CVE itself.
Thats correct, I have also now added affected versions for targeted CVEs in the description for your reference.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5333081654
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "ayushtkn (via GitHub)" <gi...@apache.org>.
ayushtkn merged PR #6635:
URL: https://github.com/apache/hive/pull/6635
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5266832899
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635) **Quality Gate passed**
Issues
 [3 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5324022566
> Thank you for the upgrade. I double checked the dependency tree, it looks good.
Thanks for the review @InvisibleProgrammer @ayushtkn
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "InvisibleProgrammer (via GitHub)" <gi...@apache.org>.
InvisibleProgrammer commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5320065047
> About using jackson-bom, ...
You are right, I missed it. Thank you.
> As for com.fasterxml.jackson.core:jackson-annotations, version number 2.21 is expected. It seems that is jackson versioning scheme and jackson-annotations uses minor version. As mentioned in jackson-bom:2.21.5:
and
> The jackson-dependencies: 2.12.7.1 from hadoop-common:3.4.2 in storage-api has scope ':provided' , which implies its not included in the final package (as seen above).
I'm not sure if I fully get it: Storage-API uses hadoop-common and it still uses an old version of jackson-databind:
```
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:provided
[INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:provided
```
Provided means the artifact itself won't contain the given dependency but still, Hive will expects those versions - just receives it from a dependency.
Is it anything against just excluding the old version here so that Hive won't requires the old version runtime?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5062127704
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5291754902
@InvisibleProgrammer thanks for the review. Here are some of my observation with respect to the discussion above.
1. About using jackson-bom, that is already in use. Even thought the CVEs mentioned are jackson-databind specific, the target version upgrade is for all **com.fasterxml.jackson.core** dependencies. For reference :
- <jackson.version>2.18.6</jackson.version>
+ <jackson.version>2.21.5</jackson.version>
]
and usage:
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
2. As for **com.fasterxml.jackson.core:jackson-annotations**, version number 2.21 is expected. It seems that is jackson versioning scheme and jackson-annotations uses minor version. As mentioned in jackson-bom:2.21.5:
<jackson.version>2.21.5</jackson.version>
<jackson.version.annotations>2.21</jackson.version.annotations>
<jackson.version.core>${jackson.version}</jackson.version.core>
<jackson.version.databind>${jackson.version}</jackson.version.databind>
<jackson.version.dataformat>${jackson.version}</jackson.version.dataformat>
<jackson.version.datatype>${jackson.version}</jackson.version.datatype>
<jackson.version.jaxrs>${jackson.version}</jackson.version.jaxrs>...
3. The jackson-dependencies: 2.12.7.1 from hadoop-common:3.4.2 in storage-api has scope **':provided'** , which implies its not included in the final package (as seen above).
All packaged jars show 2.21.5/2.21 as verified by build artifacts.
storage-api is architecturally separate and doesn't inherit Hive's dependency management by design.
for ref: [HIVE-15419](https://gitlab.pic.es/bruzzese/hive/-/commit/0d045535d42c62b7521a73427365d875e40fead5?file_path=packaging%2Fpom.xml)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5256035302
> I just found this PR because of this CVE: [GHSA-72hv-8253-57qq](https://github.com/advisories/GHSA-72hv-8253-57qq)
>
> It seems the target version fixes the problem. I see no activity on the PR for two weeks.
>
> @arorasimran0309 , is it an abandoned PR and free to pick up?
>
> If no, could you please check the dependency tree as well to handle the transitive dependency issues, if any?
>
> Thanks, Zsolt
Thanks for flagging this, Zsolt. I’ll take another look at the PR and the dependency tree, including any transitive dependencies affected by the CVE, and get back to you shortly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5266057289
Things work fine on deployed cluster
<img width="794" height="738" alt="image" src="https://github.com/user-attachments/assets/df806e84-e073-449d-b297-a746bc485cbc" />
<img width="1149" height="202" alt="image" src="https://github.com/user-attachments/assets/8cf43745-4727-4bb3-8190-3e7024fc4dc5" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "arorasimran0309 (via GitHub)" <gi...@apache.org>.
arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5266091961
Packaged jars
<img width="1149" height="202" alt="image" src="https://github.com/user-attachments/assets/8cf43745-4727-4bb3-8190-3e7024fc4dc5" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "InvisibleProgrammer (via GitHub)" <gi...@apache.org>.
InvisibleProgrammer commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5281286139
I think there are still a couple of steps to do:
I just found out recently that jackson-databind has no explicit value set in Hive. I don't know the reason behind it and also have no idea how maven chooses which version should it pick up during the compilation process. Maybe because of that, I already found an older version of jackson brought into Hive.
For example, in storage-api:
```
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:provided
[INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:provided
[INFO] | | \- com.fasterxml.jackson.core:jackson-core:jar:2.12.7:provided
```
And I also, there are other jackson dependencies than jackson-core.
I don't know the exact list of all of them but I think they should be upgraded as well to avoid bringing in the exact same CVE. As far I know, the version number of jackson-databind matches with jackson-core.
Those are the questionable dependencies that I wrote about:
```
grep '+- com.fasterxml.jackson' deps.txt | grep -v '2.21.5'
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:provided
[INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:provided
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:provided
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
```
Note:
I built Hive with `mvn clean install -DskipTests -DskipJavascript -T 1C -Pitests` so the dependencies of iTests is contained in my analysys but I'm not sure about other possible test modules. Maybe a full-build profile can deliver everything.
I used `mvn dependency:tree > deps.txt` to gather the dependencies.
Thanks,
Zsolt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5323932693
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-29761: Upgrade jackson to 2.21.5 [hive]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5329972069
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6635&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6635&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6635&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6635)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org