You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by GitBox <gi...@apache.org> on 2022/04/16 20:16:54 UTC

[GitHub] [spark] srowen opened a new pull request, #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46

srowen opened a new pull request, #36229:
URL: https://github.com/apache/spark/pull/36229

   ### What changes were proposed in this pull request?
   
   Upgrade Jetty to 9.4.46
   
   ### Why are the changes needed?
   
   Three CVEs, which don't necessarily appear to affect Spark, are fixed in this version. Just housekeeping.
   CVE-2021-28169
   CVE-2021-34428
   CVE-2021-34429
   
   ### Does this PR introduce _any_ user-facing change?
   
   No
   
   ### How was this patch tested?
   
   Existing tests


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

[GitHub] [spark] dongjoon-hyun commented on a diff in pull request #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46

Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on code in PR #36229:
URL: https://github.com/apache/spark/pull/36229#discussion_r851697063


##########
pom.xml:
##########
@@ -139,7 +139,7 @@
     <derby.version>10.14.2.0</derby.version>
     <parquet.version>1.12.2</parquet.version>
     <orc.version>1.7.4</orc.version>
-    <jetty.version>9.4.44.v20210927</jetty.version>
+    <jetty.version>9.4.46.v20220331</jetty.version>

Review Comment:
   Yes, it was a bug of Apache Maven 3.8.5. If you use the latest version (like Home-brew maven), it ignores the dependency from profiles. Recently, I uninstalled `man` from Homebrew and use `build/mvnw` always to avoid that issue.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

[GitHub] [spark] dongjoon-hyun commented on a diff in pull request #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46

Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on code in PR #36229:
URL: https://github.com/apache/spark/pull/36229#discussion_r851687931


##########
pom.xml:
##########
@@ -139,7 +139,7 @@
     <derby.version>10.14.2.0</derby.version>
     <parquet.version>1.12.2</parquet.version>
     <orc.version>1.7.4</orc.version>
-    <jetty.version>9.4.44.v20210927</jetty.version>
+    <jetty.version>9.4.46.v20220331</jetty.version>

Review Comment:
   Oh, could you update the dependency manifest?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

[GitHub] [spark] dongjoon-hyun closed pull request #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46

Posted by GitBox <gi...@apache.org>.
dongjoon-hyun closed pull request #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46
URL: https://github.com/apache/spark/pull/36229


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

[GitHub] [spark] dongjoon-hyun commented on a diff in pull request #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46

Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on code in PR #36229:
URL: https://github.com/apache/spark/pull/36229#discussion_r851697063


##########
pom.xml:
##########
@@ -139,7 +139,7 @@
     <derby.version>10.14.2.0</derby.version>
     <parquet.version>1.12.2</parquet.version>
     <orc.version>1.7.4</orc.version>
-    <jetty.version>9.4.44.v20210927</jetty.version>
+    <jetty.version>9.4.46.v20220331</jetty.version>

Review Comment:
   Yes, it was a bug of Apache Maven 3.8.5. If you use the latest version (like Home-brew maven), it ignores the dependency from profiles. Recently, I'm using `build/mvnw` always to avoid that issue.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

[GitHub] [spark] srowen commented on a diff in pull request #36229: [SPARK-38784][CORE] Upgrade Jetty to 9.4.46

Posted by GitBox <gi...@apache.org>.
srowen commented on code in PR #36229:
URL: https://github.com/apache/spark/pull/36229#discussion_r851692915


##########
pom.xml:
##########
@@ -139,7 +139,7 @@
     <derby.version>10.14.2.0</derby.version>
     <parquet.version>1.12.2</parquet.version>
     <orc.version>1.7.4</orc.version>
-    <jetty.version>9.4.44.v20210927</jetty.version>
+    <jetty.version>9.4.46.v20220331</jetty.version>

Review Comment:
   Oops, I thought it didn't generate changes when I ran, but it does. (Actually it caused a bunch of unrelated changes in the hadoop 2 profile, but I reverted those.) Added.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org