You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Alexey Serbin (Code Review)" <ge...@cloudera.org> on 2023/07/21 17:06:01 UTC
[kudu-CR](branch-1.17.x) KUDU-3493 upgrade Guava to 32.1.1-jre
Alexey Serbin has uploaded this change for review. ( http://gerrit.cloudera.org:8080/20239
Change subject: KUDU-3493 upgrade Guava to 32.1.1-jre
......................................................................
KUDU-3493 upgrade Guava to 32.1.1-jre
This is to address CVE-2023-2976 in 30.1-jre [1].
An update on java/build.gradle is a workaround as suggested by the
Guava release notes [2] to allow for building with gradle 6.x.
An update on build-support/verify_jars.pl allows for ProGuard [3]
rule files to be in the result JARs: those appeared in the compiled
JAR files with the new Guava version.
[1] https://nvd.nist.gov/vuln/detail/CVE-2023-2976
[2] https://github.com/google/guava/releases/tag/v32.1.0
[3] https://www.guardsquare.com/en/products/proguard
Change-Id: I4acf448085e2279be3ed8c77ccf3306494c6639c
Reviewed-on: http://gerrit.cloudera.org:8080/20235
Reviewed-by: Abhishek Chennaka <ac...@cloudera.com>
Tested-by: Abhishek Chennaka <ac...@cloudera.com>
Tested-by: Alexey Serbin <al...@apache.org>
(cherry picked from commit ab2f15d0dc168245d9e5adc631784f0f1be1c803)
---
M build-support/verify_jars.pl
M java/build.gradle
M java/gradle/dependencies.gradle
3 files changed, 10 insertions(+), 2 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/39/20239/1
--
To view, visit http://gerrit.cloudera.org:8080/20239
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: newchange
Gerrit-Change-Id: I4acf448085e2279be3ed8c77ccf3306494c6639c
Gerrit-Change-Number: 20239
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
[kudu-CR](branch-1.17.x) KUDU-3493 upgrade Guava to 32.1.1-jre
Posted by "Yingchun Lai (Code Review)" <ge...@cloudera.org>.
Yingchun Lai has removed a vote on this change.
Change subject: KUDU-3493 upgrade Guava to 32.1.1-jre
......................................................................
Removed Verified-1 by Kudu Jenkins (120)
--
To view, visit http://gerrit.cloudera.org:8080/20239
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: deleteVote
Gerrit-Change-Id: I4acf448085e2279be3ed8c77ccf3306494c6639c
Gerrit-Change-Number: 20239
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Yingchun Lai <la...@apache.org>
[kudu-CR](branch-1.17.x) KUDU-3493 upgrade Guava to 32.1.1-jre
Posted by "Yingchun Lai (Code Review)" <ge...@cloudera.org>.
Yingchun Lai has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/20239 )
Change subject: KUDU-3493 upgrade Guava to 32.1.1-jre
......................................................................
KUDU-3493 upgrade Guava to 32.1.1-jre
This is to address CVE-2023-2976 in 30.1-jre [1].
An update on java/build.gradle is a workaround as suggested by the
Guava release notes [2] to allow for building with gradle 6.x.
An update on build-support/verify_jars.pl allows for ProGuard [3]
rule files to be in the result JARs: those appeared in the compiled
JAR files with the new Guava version.
[1] https://nvd.nist.gov/vuln/detail/CVE-2023-2976
[2] https://github.com/google/guava/releases/tag/v32.1.0
[3] https://www.guardsquare.com/en/products/proguard
Change-Id: I4acf448085e2279be3ed8c77ccf3306494c6639c
Reviewed-on: http://gerrit.cloudera.org:8080/20235
Reviewed-by: Abhishek Chennaka <ac...@cloudera.com>
Tested-by: Abhishek Chennaka <ac...@cloudera.com>
Tested-by: Alexey Serbin <al...@apache.org>
(cherry picked from commit ab2f15d0dc168245d9e5adc631784f0f1be1c803)
Reviewed-on: http://gerrit.cloudera.org:8080/20239
Reviewed-by: Yingchun Lai <la...@apache.org>
Tested-by: Yingchun Lai <la...@apache.org>
---
M build-support/verify_jars.pl
M java/build.gradle
M java/gradle/dependencies.gradle
3 files changed, 10 insertions(+), 2 deletions(-)
Approvals:
Yingchun Lai: Looks good to me, approved; Verified
--
To view, visit http://gerrit.cloudera.org:8080/20239
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: merged
Gerrit-Change-Id: I4acf448085e2279be3ed8c77ccf3306494c6639c
Gerrit-Change-Number: 20239
Gerrit-PatchSet: 2
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Yingchun Lai <la...@apache.org>
[kudu-CR](branch-1.17.x) KUDU-3493 upgrade Guava to 32.1.1-jre
Posted by "Yingchun Lai (Code Review)" <ge...@cloudera.org>.
Yingchun Lai has posted comments on this change. ( http://gerrit.cloudera.org:8080/20239 )
Change subject: KUDU-3493 upgrade Guava to 32.1.1-jre
......................................................................
Patch Set 1: Verified+1 Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/20239
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: branch-1.17.x
Gerrit-MessageType: comment
Gerrit-Change-Id: I4acf448085e2279be3ed8c77ccf3306494c6639c
Gerrit-Change-Number: 20239
Gerrit-PatchSet: 1
Gerrit-Owner: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Yingchun Lai <la...@apache.org>
Gerrit-Comment-Date: Sat, 22 Jul 2023 00:52:30 +0000
Gerrit-HasComments: No