You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@flink.apache.org by "ChengDaqi2023 (via GitHub)" <gi...@apache.org> on 2023/07/20 02:14:07 UTC

[GitHub] [flink] ChengDaqi2023 opened a new pull request, #23030: fix(sec): upgrade com.google.guava:guava to 32.0.0-jre

ChengDaqi2023 opened a new pull request, #23030:
URL: https://github.com/apache/flink/pull/23030

   ### What happened？
   There are 1 security vulnerabilities found in com.google.guava:guava 30.0-jre
   - [CVE-2023-2976](https://www.oscs1024.com/hd/CVE-2023-2976)
   
   
   ### What did I do？
   Upgrade com.google.guava:guava from 30.0-jre to 32.0.0-jre for vulnerability fix
   
   ### What did you expect to happen？
   Ideally, no insecure libs should be used.
   
   ### The specification of the pull request
   [PR Specification](https://www.oscs1024.com/docs/pr-specification/) from OSCS


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [flink] flinkbot commented on pull request #23030: fix(sec): upgrade com.google.guava:guava to 32.0.0-jre

Posted by "flinkbot (via GitHub)" <gi...@apache.org>.

flinkbot commented on PR #23030:
URL: https://github.com/apache/flink/pull/23030#issuecomment-1643008141

   <!--
   Meta data
   {
     "version" : 1,
     "metaDataEntries" : [ {
       "hash" : "4c9b2396007652e405eb3fcd537afac0fd0ab1e5",
       "status" : "UNKNOWN",
       "url" : "TBD",
       "triggerID" : "4c9b2396007652e405eb3fcd537afac0fd0ab1e5",
       "triggerType" : "PUSH"
     } ]
   }-->
   ## CI report:
   
   * 4c9b2396007652e405eb3fcd537afac0fd0ab1e5 UNKNOWN
   
   <details>
   <summary>Bot commands</summary>
     The @flinkbot bot supports the following commands:
   
    - `@flinkbot run azure` re-run the last Azure build
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(sec): upgrade com.google.guava:guava to 32.0.0-jre [flink]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] closed pull request #23030: fix(sec): upgrade com.google.guava:guava to 32.0.0-jre
URL: https://github.com/apache/flink/pull/23030


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(sec): upgrade com.google.guava:guava to 32.0.0-jre [flink]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on PR #23030:
URL: https://github.com/apache/flink/pull/23030#issuecomment-2595363500

   This PR is being marked as stale since it has not had any activity in the last 180 days. 
   If you would like to keep this PR alive, please leave a comment asking for a review. 
   If the PR has merge conflicts, update it with the latest from the base branch.
   
   If you are having difficulty finding a reviewer, please reach out to the 
   community, contact details can be found here: https://flink.apache.org/what-is-flink/community/
   
   If this PR is no longer valid or desired, please feel free to close it. 
   If no activity occurs in the next 90 days, it will be automatically closed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(sec): upgrade com.google.guava:guava to 32.0.0-jre [flink]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on PR #23030:
URL: https://github.com/apache/flink/pull/23030#issuecomment-2774621115

   This PR has been closed since it has not had any activity in 120 days. 
   If you feel like this was a mistake, or you would like to continue working on it, 
   please feel free to re-open the PR and ask for a review.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org