You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kudu.apache.org by al...@apache.org on 2025/04/09 02:09:56 UTC
(kudu) branch branch-1.18.x updated: Upgrade Java dependencies
This is an automated email from the ASF dual-hosted git repository.
alexey pushed a commit to branch branch-1.18.x
in repository https://gitbox.apache.org/repos/asf/kudu.git
The following commit(s) were added to refs/heads/branch-1.18.x by this push:
new a31328e8b Upgrade Java dependencies
a31328e8b is described below
commit a31328e8b14e49a721e85430c58e63f253cf95b6
Author: Abhishek Chennaka <ac...@apache.org>
AuthorDate: Wed Jan 22 17:17:08 2025 -0800
Upgrade Java dependencies
Updgrades the Java dependencies and Gradle versions to mitigate
known CVE reports.
Major version upgrades:
- guava - 32.1.1-jre -> 33.3.1-jre
- hamcrest - 2.2 -> 3.0
Minor version upgrades:
- clojure - 1.10.3 -> 1.12.0
- clojuteToolsCli - 1.0.206 -> 1.1.230
- hadoop - 3.3.1 -> 3.4.1
- hdr histogram - 2.1.12 -> 2.2.2
- jmh - 1.34 -> 1.37
- log4j - 2.17.1 -> 2.24.3
- log4jCaptor - 2.9.2 -> 2.10.0
- scopt - 4.0.1 -> 4.1.0
Maintenance version upgrades:
- httpClient - 4.5.13 -> 4.5.14
- jetty - 9.4.44.v20210927 -> 9.4.57.v20241219
- scala - 2.12.15 -> 2.12.20
- scalatest - 3.2.10 -> 3.2.19
- slf4j - 1.7.33 -> 1.7.36
Gradle upgrades:
- gradle-versions-plugin - 0.41.0 -> 0.51.0
- gradle-jacoco-log - 1.2.4 -> 2.0.0
- osdetector-gradle-plugin - 1.7.0 -> 1.7.3
- nebula-clojure-plugin - 10.1.1 -> 14.2.2
- spotbugs-gradle-plugin - 4.7.0 -> 4.7.5
- gradle-animalsniffer-plugin - 1.5.4 -> 1.7.2
- guava - 31.0.1-jre -> 33.4.0-jre
mockitoCore library dependency is added to the upgraded hadoop version[1]
Changes in shadow.gradle:
Excluding classes aove Java19 as Gradle 7.6 doesn't recognize them.
Excluding Java9 version Multi-Release JAR specific classes(module-info.class).
Excluding bouncycastle due to [2].
[1] https://issues.apache.org/jira/browse/MAPREDUCE-7471
[2] https://github.com/apache/hadoop/blob/4d7825309348956336b8f06a08322b78422849b1/hadoop-client-modules/hadoop-client-runtime/pom.xml#L156-L157
Change-Id: Id1b43e3cc8228e94fbbd3085933cd62bf089e23d
Reviewed-on: http://gerrit.cloudera.org:8080/22374
Tested-by: Alexey Serbin <al...@apache.org>
Reviewed-by: Alexey Serbin <al...@apache.org>
Reviewed-by: Zoltan Chovan <zc...@cloudera.com>
(cherry picked from commit 6e67411ad69ec4bd0b075952e621a9b173fbefaf)
Reviewed-on: http://gerrit.cloudera.org:8080/22764
---
java/buildSrc/build.gradle | 16 ++++++++--------
java/gradle/dependencies.gradle | 32 ++++++++++++++++----------------
java/gradle/shadow.gradle | 11 +++++++++++
java/kudu-backup-tools/build.gradle | 3 ++-
java/kudu-hive/build.gradle | 4 ++--
5 files changed, 39 insertions(+), 27 deletions(-)
diff --git a/java/buildSrc/build.gradle b/java/buildSrc/build.gradle
index f603ab10f..23433a0b1 100644
--- a/java/buildSrc/build.gradle
+++ b/java/buildSrc/build.gradle
@@ -26,18 +26,18 @@ repositories {
// Manage plugin dependencies since the plugin block can't be used in included build scripts yet.
// For more details see: https://docs.gradle.org/current/userguide/plugins.html#plugins_dsl_limitations
dependencies {
- implementation "com.github.ben-manes:gradle-versions-plugin:0.41.0"
+ implementation "com.github.ben-manes:gradle-versions-plugin:0.51.0"
implementation "gradle.plugin.com.github.johnrengelman:shadow:7.1.2"
- implementation "gradle.plugin.org.barfuin.gradle.jacocolog:gradle-jacoco-log:1.2.4"
- implementation "gradle.plugin.com.google.gradle:osdetector-gradle-plugin:1.7.0"
+ implementation "gradle.plugin.org.barfuin.gradle.jacocolog:gradle-jacoco-log:2.0.0"
+ implementation "gradle.plugin.com.google.gradle:osdetector-gradle-plugin:1.7.3"
implementation "com.google.protobuf:protobuf-gradle-plugin:0.8.18"
- implementation "com.netflix.nebula:nebula-clojure-plugin:10.1.1"
- implementation "gradle.plugin.com.github.spotbugs.snom:spotbugs-gradle-plugin:4.7.0"
+ implementation "com.netflix.nebula:nebula-clojure-plugin:14.2.2"
+ implementation "gradle.plugin.com.github.spotbugs.snom:spotbugs-gradle-plugin:4.7.5"
implementation "net.ltgt.gradle:gradle-errorprone-plugin:2.0.2"
- implementation "ru.vyarus:gradle-animalsniffer-plugin:1.5.4"
- implementation "com.google.code.gson:gson:2.8.9"
+ implementation "ru.vyarus:gradle-animalsniffer-plugin:1.7.2"
+ implementation "com.google.code.gson:gson:2.11.0"
implementation "gradle.plugin.cz.alenkacz:gradle-scalafmt:1.16.2"
- implementation "com.google.guava:guava:31.0.1-jre"
+ implementation "com.google.guava:guava:33.4.0-jre"
implementation "me.champeau.gradle:jmh-gradle-plugin:0.5.3"
}
diff --git a/java/gradle/dependencies.gradle b/java/gradle/dependencies.gradle
index d0015dd4b..ade57f189 100755
--- a/java/gradle/dependencies.gradle
+++ b/java/gradle/dependencies.gradle
@@ -27,26 +27,26 @@ ext {
versions += [
async : "1.4.1",
checkstyle : "8.36.1",
- clojure : "1.10.3",
- clojureToolsCli: "1.0.206",
- commonsIo : "2.11.0",
+ clojure : "1.12.0",
+ clojureToolsCli: "1.1.230",
+ commonsIo : "2.15.0",
errorProne : "2.3.3",
errorProneJavac: "9+181-r4173-1",
gradle : "7.6.4",
- guava : "32.1.1-jre",
- hadoop : "3.3.1",
- hamcrest : "2.2",
- hdrhistogram : "2.1.12",
+ guava : "33.3.1-jre",
+ hadoop : "3.4.1",
+ hamcrest : "3.0",
+ hdrhistogram : "2.2.2",
hive : "3.1.2",
- httpClient : "4.5.13",
+ httpClient : "4.5.14",
jacoco : "0.8.6",
jepsen : "0.1.5",
- jetty : "9.4.44.v20210927",
- jmh : "1.34",
+ jetty : "9.4.57.v20241219",
+ jmh : "1.37",
jsr305 : "3.0.2",
junit : "4.13.2",
- log4j : "2.17.1",
- logCaptor : "2.9.2",
+ log4j : "2.24.3",
+ logCaptor : "2.10.0",
micrometer : "1.8.2",
mockito : "4.2.0",
murmur : "1.0.0",
@@ -55,10 +55,10 @@ versions += [
protobuf : "3.25.5",
ranger : "2.1.0",
scala211 : "2.11.12",
- scala : "2.12.15",
- scalatest : "3.2.10",
- scopt : "4.0.1",
- slf4j : "1.7.33",
+ scala : "2.12.20",
+ scalatest : "3.2.19",
+ scopt : "4.1.0",
+ slf4j : "1.7.36",
spark2 : "2.4.8",
spark : "3.2.4",
spotBugs : "4.1.1",
diff --git a/java/gradle/shadow.gradle b/java/gradle/shadow.gradle
index 4cf0b9a58..6fcae5510 100644
--- a/java/gradle/shadow.gradle
+++ b/java/gradle/shadow.gradle
@@ -48,6 +48,17 @@ configurations.archives.artifacts.removeAll {
// Ensure we always relocate these shaded dependencies to the same
// location across all modules.
shadowJar {
+ // TODO(achennaka): Figure out a better way to deal with MR-JAR specific files. For now
+ // we exclude everything as there were no failures seen but probably we need to exclude
+ // based on the target release version.
+ exclude "META-INF/versions/9/**"
+ // Current Gradle version(7.6.4) used to compile Java projects of Kudu project doesn't support
+ // anything above Java19.
+ // https://docs.gradle.org/current/userguide/compatibility.html#java_runtime
+ exclude "META-INF/versions/2?/"
+ // Excluding bouncycastle due to:
+ // https://github.com/apache/hadoop/blob/4d7825309348956336b8f06a08322b78422849b1/hadoop-client-modules/hadoop-client-runtime/pom.xml#L156-L157
+ exclude "org.bouncycastle:*"
relocate "com.google.common", "org.apache.kudu.shaded.com.google.common"
relocate "com.google.gradle.osdetector", "org.apache.kudu.shaded.com.google.gradle.osdetector"
relocate "com.google.gson", "org.apache.kudu.shaded.com.google.gson"
diff --git a/java/kudu-backup-tools/build.gradle b/java/kudu-backup-tools/build.gradle
index ff5c842a3..cd61c97b3 100644
--- a/java/kudu-backup-tools/build.gradle
+++ b/java/kudu-backup-tools/build.gradle
@@ -32,6 +32,7 @@ dependencies {
compileOnly libs.hadoopClient
implementation libs.yetusAnnotations
+ implementation libs.mockitoCore
testImplementation project(path: ":kudu-test-utils", configuration: "shadow")
testImplementation libs.hadoopMiniCluster
@@ -53,4 +54,4 @@ javadoc {
tasks.withType(com.github.spotbugs.snom.SpotBugsTask) {
// This class causes SpotBugs runtime errors, so we completely ignore it from analysis.
classes = classes.filter { !it.path.contains("BaseTestKuduBackupCleaner") }
-}
\ No newline at end of file
+}
diff --git a/java/kudu-hive/build.gradle b/java/kudu-hive/build.gradle
index b81e0b2ae..bf27fc002 100644
--- a/java/kudu-hive/build.gradle
+++ b/java/kudu-hive/build.gradle
@@ -23,7 +23,7 @@ dependencies {
compileOnly libs.slf4jApi
// Transitively required through hive-metastore,
// which has marked it as an optional dependency.
- compileOnly libs.hadoopCommon
+ implementation libs.hadoopCommon
testImplementation libs.hadoopMRClientCommon
testImplementation project(path: ":kudu-test-utils", configuration: "shadow")
@@ -82,4 +82,4 @@ shadowJar {
// kudu-hive has no public Javadoc.
javadoc {
enabled = false
-}
\ No newline at end of file
+}