You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@zookeeper.apache.org by GitBox <gi...@apache.org> on 2021/08/05 09:00:19 UTC

[GitHub] [zookeeper] ztzg commented on pull request #1735: ZOOKEEPER-4343: Bump commons-io to version 2.7 (avoids CVE-2021-29425)

ztzg commented on pull request #1735:
URL: https://github.com/apache/zookeeper/pull/1735#issuecomment-893289952


   @nkalmar, @eolivelli: This one is only for `master` (the dependency on `commons-io` was introduced by [ZOOKEEPER-3922](https://issues.apache.org/jira/browse/ZOOKEEPER-3922), "introduction of the oracle, a failure detector."
   
   I have a few notes/questions:
   
   -   I have refactored the `commons-io` dependency into the toplevel POM, which is why there are two commits;
   -   Should I try and bump to the latest version of `commons-io`, which is 2.11?
   -   I have added the "missing" `*.LICENSE.txt` file for `commons-io` (it mirrors `META-INF/LICENSE.txt` in the Maven-downloaded JAR). But perhaps that file was "missing" on purpose?
   
   Cheers, -D
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org