[jira] [Created] (HBASE-21143) Update findbugs-maven-plugin to 3.0.4

["Guangxu Cheng (JIRA)" <ji...@apache.org>]

Guangxu Cheng created HBASE-21143:
-------------------------------------

             Summary: Update findbugs-maven-plugin to 3.0.4
                 Key: HBASE-21143
                 URL: https://issues.apache.org/jira/browse/HBASE-21143
             Project: HBase
          Issue Type: Bug
          Components: pom
    Affects Versions: 2.0.2, 2.1.0, 3.0.0, 2.2.0
            Reporter: Guangxu Cheng
            Assignee: Guangxu Cheng


{code}
Failed to execute goal org.codehaus.mojo:findbugs-maven-plugin:3.0.0:findbugs (default) on project hbase: Execution default of goal org.codehaus.mojo:findbugs-maven-plugin:3.0.0:findbugs failed: Plugin org.codehaus.mojo:findbugs-maven-plugin:3.0.0 or one of its dependencies could not be resolved: Failed to collect dependencies at org.codehaus.mojo:findbugs-maven-plugin:jar:3.0.0 -> org.codehaus.groovy:groovy-all:jar:1.7.4: Failed to read artifact descriptor for org.codehaus.groovy:groovy-all:jar:1.7.4: Could not transfer artifact org.codehaus.groovy:groovy-all:pom:1.7.4 from/to mirror (http://xxx.xxxx.xxx/nexus/content/groups/public): Failed to transfer file: http://xxx.xxxx.xxx/nexus/content/groups/public/org/codehaus/groovy/groovy-all/1.7.4/groovy-all-1.7.4.pom. Return code is: 418 , ReasonPhrase:Artifact is in Tencent Blacklist! Please update to the safe version, more information: http://xxx.xxxx.xxx/?tab=blackList.
{code}
Recently, when I compile HBase with a new machine, I got the above error. Since the machine could not connect to the external network, we visited our internal Maven repository, but org.codehaus.groovy:groovy-all:jar:1.7.4 was added to the blacklist and could not be downloaded. See details, org.codehaus.groovy:groovy-all:jar:1.7.4 is marked as vulnerable by [CVE-2015-3253|https://www.cvedetails.com/cve/CVE-2015-3253], so we should upgrade the version.
{code:xml}
              <groupId>org.codehaus.mojo</groupId>
              <artifactId>findbugs-maven-plugin</artifactId>
              <version>3.0.0</version>
              <!--NOTE: Findbugs 3.0.0 requires jdk7-->
              <configuration>
                <excludeFilterFile>${project.basedir}/../dev-support/findbugs-exclude.xml</excludeFilterFile>
{code}
Look at the history commit record, findbugs-maven-plugin has been upgraded to 3.0.4 in HBASE-18264, but one place is missing which still using the version of 3.0.0.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)