You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by xi...@apache.org on 2023/02/03 03:11:35 UTC
[pulsar] 01/01: Updating dependencies to get rid of CVEs brought in with kafka and log4j-1.2 libs (#13726)
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a commit to branch 2.10.4/fix_dependencies
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 551373119ef8ae54ec2ee6e9459a90b031b99f81
Author: Andrey Yegorov <86...@users.noreply.github.com>
AuthorDate: Mon Jan 17 01:15:27 2022 -0800
Updating dependencies to get rid of CVEs brought in with kafka and log4j-1.2 libs (#13726)
CVE-2020-27218,
CVE-2021-38153,
CVE-2021-44228,
CVE-2021-44832,
CVE-2021-45046,
CVE-2021-45105,
CVE-2020-9488,
CVE-2019-17571,
CVE-2021-4104
(cherry picked from commit 3acdbfe4eac79040be140b423342c28a07dc0327)
---
pom.xml | 1 +
pulsar-io/kafka/pom.xml | 10 ++++++++++
2 files changed, 11 insertions(+)
diff --git a/pom.xml b/pom.xml
index ecbeccde621..ec8ce75ac92 100644
--- a/pom.xml
+++ b/pom.xml
@@ -156,6 +156,7 @@ flexible messaging model and an intuitive client API.</description>
<hdfs-offload-version3>3.3.3</hdfs-offload-version3>
<json-smart.version>2.4.7</json-smart.version>
<opensearch.version>1.2.4</opensearch.version>
+ <elasticsearch.version>7.9.1</elasticsearch.version>
<presto.version>332</presto.version>
<scala.binary.version>2.13</scala.binary.version>
<scala-library.version>2.13.10</scala-library.version>
diff --git a/pulsar-io/kafka/pom.xml b/pulsar-io/kafka/pom.xml
index 8f918c711cd..bf7df378988 100644
--- a/pulsar-io/kafka/pom.xml
+++ b/pulsar-io/kafka/pom.xml
@@ -85,6 +85,16 @@
<groupId>io.confluent</groupId>
<artifactId>kafka-schema-registry-client</artifactId>
<version>${kafka.confluent.schemaregistryclient.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-log4j12</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>