You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@xtable.apache.org by "the-other-tim-brown (via GitHub)" <gi...@apache.org> on 2024/05/24 22:27:21 UTC
[PR] [446] Upgrade or remove dependencies with known vulnerabilities [incubator-xtable]
the-other-tim-brown opened a new pull request, #447:
URL: https://github.com/apache/incubator-xtable/pull/447
## What is the purpose of the pull request
Addresses #446
Upgrades or removes some dependencies that were flagged by security tooling for identifying vulnerable dependencies.
## Brief change log
- Exclude zookeeper as we do not require it and the version had a vulnerability reported
- Upgrade jackson to avoid vulnerabilities in the library modules and its dependencies
- Remove Hive from the path - this jar was just included for the utilities bundle but users can add their own implementation to the path
- netty - upgrade version by using BOM to ensure consistent version
- jetty - upgrade version by using BOM to ensure consistent version
- Pin versions for transitive dependencies like: snappy, commons-compress, commons-configuration, ivy, jettison, numbus-jose-jwt
## Verify this pull request
TODO
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@xtable.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [446] Upgrade or remove dependencies with known vulnerabilities [incubator-xtable]
Posted by "the-other-tim-brown (via GitHub)" <gi...@apache.org>.
the-other-tim-brown merged PR #447:
URL: https://github.com/apache/incubator-xtable/pull/447
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@xtable.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [446] Upgrade or remove dependencies with known vulnerabilities [incubator-xtable]
Posted by "xtable-bot (via GitHub)" <gi...@apache.org>.
xtable-bot commented on PR #447:
URL: https://github.com/apache/incubator-xtable/pull/447#issuecomment-2130451134
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9a1f054e77ed5f77d0527b7317c2812d5f88b97c",
"status" : "PENDING",
"url" : "https://dev.azure.com/apache-xtable-ci-org/bb368b1b-7955-479d-8cbf-689ff9aa23eb/_build/results?buildId=998",
"triggerID" : "9a1f054e77ed5f77d0527b7317c2812d5f88b97c",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 9a1f054e77ed5f77d0527b7317c2812d5f88b97c Azure: [PENDING](https://dev.azure.com/apache-xtable-ci-org/bb368b1b-7955-479d-8cbf-689ff9aa23eb/_build/results?buildId=998)
<details>
<summary>Bot commands</summary>
@xtable-bot supports the following commands:
- `@xtable-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@xtable.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [446] Upgrade or remove dependencies with known vulnerabilities [incubator-xtable]
Posted by "xtable-bot (via GitHub)" <gi...@apache.org>.
xtable-bot commented on PR #447:
URL: https://github.com/apache/incubator-xtable/pull/447#issuecomment-2130473440
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9a1f054e77ed5f77d0527b7317c2812d5f88b97c",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apache-xtable-ci-org/bb368b1b-7955-479d-8cbf-689ff9aa23eb/_build/results?buildId=998",
"triggerID" : "9a1f054e77ed5f77d0527b7317c2812d5f88b97c",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 9a1f054e77ed5f77d0527b7317c2812d5f88b97c Azure: [SUCCESS](https://dev.azure.com/apache-xtable-ci-org/bb368b1b-7955-479d-8cbf-689ff9aa23eb/_build/results?buildId=998)
<details>
<summary>Bot commands</summary>
@xtable-bot supports the following commands:
- `@xtable-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@xtable.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [446] Upgrade or remove dependencies with known vulnerabilities [incubator-xtable]
Posted by "xtable-bot (via GitHub)" <gi...@apache.org>.
xtable-bot commented on PR #447:
URL: https://github.com/apache/incubator-xtable/pull/447#issuecomment-2130448099
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9a1f054e77ed5f77d0527b7317c2812d5f88b97c",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "9a1f054e77ed5f77d0527b7317c2812d5f88b97c",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 9a1f054e77ed5f77d0527b7317c2812d5f88b97c UNKNOWN
<details>
<summary>Bot commands</summary>
@xtable-bot supports the following commands:
- `@xtable-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@xtable.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [446] Upgrade or remove dependencies with known vulnerabilities [incubator-xtable]
Posted by "vinothchandar (via GitHub)" <gi...@apache.org>.
vinothchandar commented on code in PR #447:
URL: https://github.com/apache/incubator-xtable/pull/447#discussion_r1614799525
##########
pom.xml:
##########
@@ -452,10 +455,51 @@
<artifactId>commons-lang3</artifactId>
<version>3.12.0</version>
</dependency>
+
+ <!-- Manage transitive dependency versions that have vulnerabilities reported -->
+ <dependency>
+ <groupId>org.xerial.snappy</groupId>
+ <artifactId>snappy-java</artifactId>
+ <version>1.1.10.5</version>
Review Comment:
Can we eventually pull all version numbers into properties. Not a blocker for this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@xtable.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org