You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fory.apache.org by "stevenschlansker (via GitHub)" <gi...@apache.org> on 2025/07/16 21:53:17 UTC
[PR] chore(java): arrow 18.3.0 [fory]
stevenschlansker opened a new pull request, #2421:
URL: https://github.com/apache/fory/pull/2421
arrow 15.0.0 is marked as vulnerable to CVE-2024-52338 Despite this CVE only affecting the R implementation, the CPE is not scoped to R so Java checkers will report as vulnerable:
```
13:25:42 [ERROR] One or more dependencies were identified with vulnerabilities:
13:25:42 [ERROR] arrow-memory-core-15.0.0.jar (pkg:maven/org.apache.arrow/arrow-memory-core@15.0.0, cpe:2.3:a:apache:arrow:15.0.0:*:*:*:*:*:*:*): CVE-2024-52338(9.8)
```
while this is really a problem with the CPE, the easiest fix by far is to simply update arrow
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "stevenschlansker (via GitHub)" <gi...@apache.org>.
stevenschlansker commented on PR #2421:
URL: https://github.com/apache/fory/pull/2421#issuecomment-3099309716
Sounds good to me, thank you for considering this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "stevenschlansker (via GitHub)" <gi...@apache.org>.
stevenschlansker commented on PR #2421:
URL: https://github.com/apache/fory/pull/2421#issuecomment-3081233240
Well, this did not work as well as I had hoped, it seems Arrow has ended support for Java 8:
```
Error: bad class file: /home/runner/.m2/repository/org/apache/arrow/arrow-vector/18.3.0/arrow-vector-18.3.0.jar(org/apache/arrow/vector/types/pojo/Field.class)
Error: class file has wrong version 55.0, should be 52.0
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "stevenschlansker (via GitHub)" <gi...@apache.org>.
stevenschlansker commented on PR #2421:
URL: https://github.com/apache/fory/pull/2421#issuecomment-3085525816
That would be nice, but I worry it would complicated the build and release process and ci pipelines a fair bit...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "stevenschlansker (via GitHub)" <gi...@apache.org>.
stevenschlansker closed pull request #2421: chore(java): arrow 18.3.0
URL: https://github.com/apache/fory/pull/2421
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on PR #2421:
URL: https://github.com/apache/fory/pull/2421#issuecomment-3094603127
Maven support use different java version for different module::
```xml
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.10.1</version>
<configuration>
<release>${maven.compiler.release}</release>
</configuration>
</plugin>
</plugins>
</build>
```
but it needs an extra toolchains.xml file to specify different jdk install location.
```
mvn clean install --toolchains toolchains.xml
```
```
<?xml version="1.0" encoding="UTF8"?>
<toolchains>
<toolchain>
<type>jdk</type>
<provides>
<version>11</version>
</provides>
<configuration>
<jdkHome>/path/to/jdk-11</jdkHome>
</configuration>
</toolchain>
<toolchain>
<type>jdk</type>
<provides>
<version>17</version>
</provides>
<configuration>
<jdkHome>/path/to/jdk-17</jdkHome>
</configuration>
</toolchain>
</toolchains>
```
I can configure all modules to java 11 to skip this, but when running on ci and making release, we use a scipt to automatically switched to use this "polyglot" Maven builds. This won't introduce too much burden to users and contributors
I think we can do it after #2406 is merged
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "stevenschlansker (via GitHub)" <gi...@apache.org>.
stevenschlansker commented on PR #2421:
URL: https://github.com/apache/fory/pull/2421#issuecomment-3084757578
I guess we cannot upgrade Arrow anymore. No new bugfixes and no new features, to stay on ancient and unsupported Java 8 :disappointed:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] chore(java): arrow 18.3.0 [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on PR #2421:
URL: https://github.com/apache/fory/pull/2421#issuecomment-3084902726
we could make `fory-format` to use java11+ or java17, but still needs to let `fory-core` use java8. Serialization is so foundamental, that lots of online system still use java8. But for fory-format,, since it's nto fory online system, we could just upgrade to java11+
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org