[GitHub] [shardingsphere] linghengqian commented on pull request #15260: [issue-15259] upgrade snakeyaml due to cve

[GitBox <gi...@apache.org>]

linghengqian commented on pull request #15260:
URL: https://github.com/apache/shardingsphere/pull/15260#issuecomment-1034617873


   I noticed after testing that I changed `snakeyaml.version` to `1.18` and modified `NoneYamlTupleProcessor.java` and `YamlTupleProcessorFixture.java` as in the PR, the result of executing `./mvnw -T 1C clean install` is normal pass Yes, the build fails starting from `1.19` (two classes seem to have to be changed, and only changing `snakeyaml.version` to `1.18` still fails the build). Maybe an important API change happened in `org.yaml:snakeyaml: 1.19 `(For example, I pointed out `java.lang.ClassCastException: class java.util.LinkedHashMap cannot be cast to class org.apache.shardingsphere.infra.executor.sql.process.model.yaml.YamlExecuteProcessUnit (java. util.LinkedHashMap is in module java.base of loader 'bootstrap'; org.apache.shardingsphere.infra.executor.sql.process.model.yaml.YamlExecuteProcessUnit is in unnamed module of loader 'app') `), I am in https ://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes also see the instructions for seeing backward-incompatible changes.
   - `snakeyaml.version`=`1.18`
   - ![image](https://user-images.githubusercontent.com/20187731/153363780-e7d9420f-5671-4e6e-ada3-f5df705455d4.png)
   - `snakeyaml.version`=`1.19`
   - ![image](https://user-images.githubusercontent.com/20187731/153366146-96a70aed-8c6c-4ccf-9023-b56ca7857e17.png)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@shardingsphere.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org