You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "devin-petersohn (via GitHub)" <gi...@apache.org> on 2026/04/17 17:54:14 UTC
[PR] [SPARK-56488][BUILD] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
devin-petersohn opened a new pull request, #55394:
URL: https://github.com/apache/spark/pull/55394
### What changes were proposed in this pull request?
Bump Scala 2.13 from 2.13.8 to 2.13.9 to fix CVE-2022-36944 (CVSS 9.8). Includes build fixes required for 2.13.9 compatibility: clearing `maven.compiler.target` to avoid `-release 8` from scala-maven-plugin, removing deprecated `-target:jvm-1.8`, and fixing `StringBuilder.append` overload ambiguity.
### Why are the changes needed?
To fix CVE-2022-36944.
### Does this PR introduce _any_ user-facing change?
Yes. Users building with the `-Pscala-2.13` profile will now use Scala 2.13.9 instead of 2.13.8.
### How was this patch tested?
Compilation verified with both Scala 2.12 and 2.13.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4271368477
Scala has been very notorious at every maintenance version in the Apache Spark community. I don't think we can set up to build a new set of CIs for that new profile (including Scala/PySpark/SparkR) to guarantee. Let's not to give a misleading signal.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #55394: [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5
URL: https://github.com/apache/spark/pull/55394
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "holdenk (via GitHub)" <gi...@apache.org>.
holdenk commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4792748577
Just double checking was the builder change required @devin-petersohn or was it a cleanup to remove a warning?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "holdenk (via GitHub)" <gi...@apache.org>.
holdenk commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4271393781
I see what you mean about not wanting the CI overhead and verification overhead. Let me think about this over the weekend and see if I can come up with another workaround that would let us do both, otherwise maybe given it's only on Scala deser it's an ok / non exploitable CVE.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4271427393
IIRC, the Apache Spark community never takes a risk to change Scala language version in the maintenance releases, @holdenk .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-5963740237
We're closing this PR because it hasn't been updated in a while. This isn't a judgement on the merit of the PR in any way. It's just a way of keeping the PR queue manageable.
If you'd like to revive this PR, please reopen it and ask a committer to remove the Stale tag!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "holdenk (via GitHub)" <gi...@apache.org>.
holdenk commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4271314579
What about if we added a new profile for the newer Scala version? That way we can release binary compat version, but if anyone is worried about this they can build with the different profile?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4270301470
cc @holdenk
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4271422089
If there is no code change, it would be easier to us to support because a user may change `scala.version` during their building. According to this PR, the code change seems to be required which means a non-trivial update.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-56488][BUILD][3.5] Bump Scala 2.13 to 2.13.9 on branch-3.5 [spark]
Posted by "holdenk (via GitHub)" <gi...@apache.org>.
holdenk commented on PR #55394:
URL: https://github.com/apache/spark/pull/55394#issuecomment-4270308726
Oh awesome, yeah I was talking with @devin-petersohn about this, thanks for making the PR so fast!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org