You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by lh...@apache.org on 2023/09/30 11:17:22 UTC
[pulsar] branch branch-3.1 updated (80fb39085b4 -> 9cd2f9e4f6b)
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a change to branch branch-3.1
in repository https://gitbox.apache.org/repos/asf/pulsar.git
from 80fb39085b4 Release 3.1.1
new efc4bf392e9 [fix][sec] Add OWASP Dependency Check suppressions (#21281)
new 9cd2f9e4f6b [fix][build] Upgrade Lombok to 1.18.30 to support compiling with JDK21 (#21278)
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
pom.xml | 2 +-
src/owasp-dependency-check-suppressions.xml | 12 ++++++++++++
2 files changed, 13 insertions(+), 1 deletion(-)
[pulsar] 02/02: [fix][build] Upgrade Lombok to 1.18.30 to support compiling with JDK21 (#21278)
Posted by lh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-3.1
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 9cd2f9e4f6ba15354a840121c62cf173b2cb8264
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Sat Sep 30 12:14:11 2023 +0300
[fix][build] Upgrade Lombok to 1.18.30 to support compiling with JDK21 (#21278)
(cherry picked from commit 682eb36a76746fd47ce57dd8915e3d4603aa039e)
# Conflicts:
# pom.xml
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index d405def7668..f77db0323c9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -223,7 +223,7 @@ flexible messaging model and an intuitive client API.</description>
<hppc.version>0.9.1</hppc.version>
<spark-streaming_2.10.version>2.1.0</spark-streaming_2.10.version>
<assertj-core.version>3.24.2</assertj-core.version>
- <lombok.version>1.18.26</lombok.version>
+ <lombok.version>1.18.30</lombok.version>
<javax.annotation-api.version>1.3.2</javax.annotation-api.version>
<jaxb-api>2.3.1</jaxb-api>
<javax.activation.version>1.2.0</javax.activation.version>
[pulsar] 01/02: [fix][sec] Add OWASP Dependency Check suppressions (#21281)
Posted by lh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch branch-3.1
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit efc4bf392e9ee95bd4625a7b7e964f8c1fe6d726
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Sat Sep 30 11:27:36 2023 +0300
[fix][sec] Add OWASP Dependency Check suppressions (#21281)
(cherry picked from commit 1bf7371b6d33c4e015d006e547b393b97686ff20)
---
src/owasp-dependency-check-suppressions.xml | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml
index d5ddc28e884..b5bb58c3d0e 100644
--- a/src/owasp-dependency-check-suppressions.xml
+++ b/src/owasp-dependency-check-suppressions.xml
@@ -457,4 +457,16 @@
]]></notes>
<cve>CVE-2023-35116</cve>
</suppress>
+ <suppress>
+ <notes><![CDATA[
+ This is a false positive in avro-protobuf. The vulnerability is in Hamba avro golang library.
+ ]]></notes>
+ <cve>CVE-2023-37475</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ This CVE can be suppressed since it is covered in Pulsar by hostname verification changes made in https://github.com/apache/pulsar/pull/15824.
+ ]]></notes>
+ <cve>CVE-2023-4586</cve>
+ </suppress>
</suppressions>