You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fineract.apache.org by "IOhacker (via GitHub)" <gi...@apache.org> on 2024/05/29 00:47:59 UTC
[PR] Upgrade java dependencies/libraries [fineract]
IOhacker opened a new pull request, #3906:
URL: https://github.com/apache/fineract/pull/3906
## Description
Upgrade java dependencies/libraries
## Checklist
Please make sure these boxes are checked before submitting your pull request - thanks!
- [ ] Write the commit message as per https://github.com/apache/fineract/#pull-requests
- [ ] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers.
- [ ] Create/update unit or integration tests for verifying the changes made.
- [ ] Follow coding conventions at https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions.
- [ ] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes
- [ ] Submission is not a "code dump". (Large changes can be made "in repository" via a branch. Ask on the developer mailing list for guidance, if required.)
FYI our guidelines for code reviews are at https://cwiki.apache.org/confluence/display/FINERACT/Code+Review+Guide.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy commented on PR #3906:
URL: https://github.com/apache/fineract/pull/3906#issuecomment-2140594729
> Can we remove quartz dependency? For now, let's keep the quartz dependency "as is" and make a note that this CVE doesn't apply. But didn't we already deprecate the quartz when we implemented Spring Batch and the COB concepts?
No, quartz is used for scheduling the jobs. if we wanna remove, we need to have something to take care of scheduling.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "jdailey (via GitHub)" <gi...@apache.org>.
jdailey commented on PR #3906:
URL: https://github.com/apache/fineract/pull/3906#issuecomment-2140348701
Can we remove quartz dependency? For now, let's keep the quartz dependency "as is" and make a note that this CVE doesn't apply. But didn't we already deprecate the quartz when we implemented Spring Batch and the COB concepts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1618320173
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -84,7 +84,6 @@ dependencyManagement {
exclude 'commons-io:commons-io'
exclude 'commons-logging:commons-logging'
exclude 'commons-codec:commons-codec'
- exclude 'org.apache.commons:commons-compress'
Review Comment:
Do we need this package for something?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "IOhacker (via GitHub)" <gi...@apache.org>.
IOhacker commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1618326865
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -84,7 +84,6 @@ dependencyManagement {
exclude 'commons-io:commons-io'
exclude 'commons-logging:commons-logging'
exclude 'commons-codec:commons-codec'
- exclude 'org.apache.commons:commons-compress'
Review Comment:
It is being excluded, in the original file, exclusion is declared twice. I have removed one of them to avoid duplicated lines.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "IOhacker (via GitHub)" <gi...@apache.org>.
IOhacker merged PR #3906:
URL: https://github.com/apache/fineract/pull/3906
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "IOhacker (via GitHub)" <gi...@apache.org>.
IOhacker commented on PR #3906:
URL: https://github.com/apache/fineract/pull/3906#issuecomment-2136436132
@jdailey
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "IOhacker (via GitHub)" <gi...@apache.org>.
IOhacker commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1618328065
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -68,7 +68,7 @@ dependencyManagement {
exclude 'org.codehaus.groovy:groovy'
}
dependency 'org.apache.commons:commons-csv:1.10.0'
- dependency 'org.quartz-scheduler:quartz:2.3.2'
+ dependency 'org.quartz-scheduler:quartz:2.5.0-rc1'
Review Comment:
About Quartz library I can see that they have not released any security fix and project seems to be abandoned
https://github.com/quartz-scheduler/quartz/issues/1134
Anyway the last version is 2.5.0-rc1, so then the question is;
Should we use a Release Candidate version? If not should we keep using a library version released in 2019 ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1618690282
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -68,7 +68,7 @@ dependencyManagement {
exclude 'org.codehaus.groovy:groovy'
}
dependency 'org.apache.commons:commons-csv:1.10.0'
- dependency 'org.quartz-scheduler:quartz:2.3.2'
+ dependency 'org.quartz-scheduler:quartz:2.5.0-rc1'
Review Comment:
https://github.com/quartz-scheduler/quartz/issues/943
We dont have quartz-job artifact, neither the class thats the CVE is talking about.
I dont think the reported CVE applies to us...
You might wanna discuss internally what steps we should do.
@vidakovic Any thoughts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "IOhacker (via GitHub)" <gi...@apache.org>.
IOhacker commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1620856965
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -68,7 +68,7 @@ dependencyManagement {
exclude 'org.codehaus.groovy:groovy'
}
dependency 'org.apache.commons:commons-csv:1.10.0'
- dependency 'org.quartz-scheduler:quartz:2.3.2'
+ dependency 'org.quartz-scheduler:quartz:2.5.0-rc1'
Review Comment:
@jdailey @vidakovic @adamsaghy I think this should be a false positive. Anyway the Quartz library maintenance/very low activity is a red flag, becaue the library now seems abandoned.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "adamsaghy (via GitHub)" <gi...@apache.org>.
adamsaghy commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1618309920
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -68,7 +68,7 @@ dependencyManagement {
exclude 'org.codehaus.groovy:groovy'
}
dependency 'org.apache.commons:commons-csv:1.10.0'
- dependency 'org.quartz-scheduler:quartz:2.3.2'
+ dependency 'org.quartz-scheduler:quartz:2.5.0-rc1'
Review Comment:
i dont think we should use RC version. I am not convinced the CVE is effecting us. I am still digesting it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2089 Upgrade java dependencies/libraries [fineract]
Posted by "IOhacker (via GitHub)" <gi...@apache.org>.
IOhacker commented on code in PR #3906:
URL: https://github.com/apache/fineract/pull/3906#discussion_r1620853029
##########
buildSrc/src/main/groovy/org.apache.fineract.dependencies.gradle:
##########
@@ -68,7 +68,7 @@ dependencyManagement {
exclude 'org.codehaus.groovy:groovy'
}
dependency 'org.apache.commons:commons-csv:1.10.0'
- dependency 'org.quartz-scheduler:quartz:2.3.2'
+ dependency 'org.quartz-scheduler:quartz:2.5.0-rc1'
Review Comment:
Comments about the issue https://github.com/quartz-scheduler/quartz/issues/943 for now I have rollbacked to the original version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org