You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hudi.apache.org by "Youngwb (via GitHub)" <gi...@apache.org> on 2025/03/07 07:56:56 UTC
[I] The JAR file that Hudi Common depends on has vulnerabilities. [hudi]
Youngwb opened a new issue, #12930:
URL: https://github.com/apache/hudi/issues/12930
hudi common depends on `hbase-protocol-shaded-2.4.13.jar` and `htrace-core4-4.2.0-incubating.jar`
Among them, `hbase-protocol-shaded` also depends on ` htrace-core` .
The htrace-core dependency on jackson-databind has many vulnerabilities.
We want to exclude `jackson-databind ` using Maven's <exclusions> mechanism. However, these two JAR files are packaged using the Maven Shade Plugin, and there is no direct way to exclude them.
Does the community currently have a way to work around this issue, or is there a plan to fix this vulnerability?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The JAR file that Hudi Common depends on has vulnerabilities. [hudi]
Posted by "Youngwb (via GitHub)" <gi...@apache.org>.
Youngwb commented on issue #12930:
URL: https://github.com/apache/hudi/issues/12930#issuecomment-2709235946
@rangareddy thx for your replay, I use hudi-common (https://mvnrepository.com/artifact/org.apache.hudi/hudi-common) as dependency in my project, so I need to build a custom hudi common？
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The JAR file that Hudi Common depends on has vulnerabilities. [hudi]
Posted by "rangareddy (via GitHub)" <gi...@apache.org>.
rangareddy commented on issue #12930:
URL: https://github.com/apache/hudi/issues/12930#issuecomment-2706985013
Hi @Youngwb
The two jars mentioned above are from HBase and its dependent jars. To avoid vulnerabilities, you can build custom HBase jars by excluding the jars that contain the vulnerabilities.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The JAR file that Hudi Common depends on has vulnerabilities. [hudi]
Posted by "rangareddy (via GitHub)" <gi...@apache.org>.
rangareddy commented on issue #12930:
URL: https://github.com/apache/hudi/issues/12930#issuecomment-2724184354
> [@rangareddy](https://github.com/rangareddy) thx for your replay, I use hudi-common (https://mvnrepository.com/artifact/org.apache.hudi/hudi-common) as dependency in my java project, so I need to build a custom hudi common which exculsion hbase-protocol-shaded and htrace-core4？
Yes, you need to build custom HBase jars by ignoring the vulnerabilities jars.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org