github-actions[bot] commented on code in PR #67000:
URL: https://github.com/apache/doris/pull/67000#discussion_r3826495852
##########
fe/pom.xml:
##########
@@ -579,13 +611,48 @@ under the License.
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- Keep all OpenTelemetry API, SDK, and exporter artifacts on
the CVE-2026-45292-fixed line. -->
+ <dependency>
+ <groupId>io.opentelemetry</groupId>
+ <artifactId>opentelemetry-bom</artifactId>
+ <version>${opentelemetry.version}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson.version}</version>
<scope>import</scope>
<type>pom</type>
</dependency>
+ <!-- Override Spring Boot's vulnerable HttpComponents 5 versions.
-->
+ <dependency>
+ <groupId>org.apache.httpcomponents.client5</groupId>
+ <artifactId>httpclient5</artifactId>
+ <version>${httpclient5.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.httpcomponents.core5</groupId>
+ <artifactId>httpcore5</artifactId>
+ <version>${httpcore5.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.httpcomponents.core5</groupId>
+ <artifactId>httpcore5-h2</artifactId>
+ <version>${httpcore5.version}</version>
+ </dependency>
+ <!-- First redirect archived org.lz4 dependencies, then select the
fixed maintained release. -->
+ <dependency>
+ <groupId>org.lz4</groupId>
Review Comment:
[P1] Avoid introducing the vulnerable legacy LZ4 coordinate
This management entry makes the current-head `dependency-review` job fail:
the action reports both GHSA-cmp6-m4wj-q63q (high) and GHSA-xx22-p4ch-683r
(moderate) for `fe/pom.xml » org.lz4:[email protected]` and exits with “Dependency
review detected vulnerable packages.” Maven itself follows the relocation and
then manages the target to `at.yawk.lz4:lz4-java:1.11.1`, but the repository's
required manifest-level security gate treats the relocation POM as a newly
introduced vulnerable dependency. Please remove the legacy declaration and
migrate the actual incoming edges (for example, exclusions plus the maintained
coordinate) in a way that leaves no `org.lz4` entry for the gate to flag.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
