CVE -2020-28458, How to upgrade datatables dependency

2022-04-13 Thread Pralabh Kumar
Hi Dev Team Spark 3.2 (and 3.3 might also) have CVE 2020-28458. Therefore in my local repo of Spark I would like to update DataTables to 1.11.5. Can you please help me to point out where I should upgrade DataTables dependency ?. Regards Pralabh Kumar

Re: CVE -2020-28458, How to upgrade datatables dependency

2022-04-13 Thread Sean Owen
You can see the files in core/src/main/resources/org/apache/spark/ui/static - you can try dropping in the new minified versions and see if the UI is OK. You can open a pull request if it works to update it, in case this affects Spark. It looks like the smaller upgrade to 1.10.22 is also