FrankChen021 opened a new pull request, #19806:
URL: https://github.com/apache/druid/pull/19806
## What changed
- remove the Cassandra storage module's local dependency-management pin for
`org.yaml:snakeyaml:1.33`
- exclude SnakeYAML from the transitive `astyanax -> cassandra-all`
dependency chain
## Why
Dependabot alert #297 reports a constructor-deserialization vulnerability in
SnakeYAML 1.33. The Cassandra storage extension was overriding Druid's root
dependency management to keep this vulnerable version in its runtime graph.
Cassandra 1.0.8 uses old SnakeYAML APIs that were removed in SnakeYAML 2.x,
including `org.yaml.snakeyaml.Loader` and `Constructor(Class)`. Replacing 1.33
with the root-managed 2.5 would therefore leave binary-incompatible
server-configuration classes on the classpath.
The Druid extension uses Astyanax's Cassandra client/thrift APIs and does
not use Cassandra's YAML server-configuration loader. Excluding this unused
transitive dependency removes the vulnerable artifact without introducing a
knowingly incompatible replacement.
## Impact
The Cassandra storage extension no longer packages SnakeYAML through
Astyanax/Cassandra. Other modules and root dependency management are unchanged.
## Verification
- `mvn -ntp dependency:tree -pl extensions-contrib/cassandra-storage
-Dincludes=org.yaml:snakeyaml -Pskip-static-checks -Dweb.console.skip=true -T1C`
- succeeds with no SnakeYAML artifact in the module dependency tree
- `mvn -ntp test -pl extensions-contrib/cassandra-storage
-Pskip-static-checks -Dweb.console.skip=true -T1C`
- succeeds and compiles all six module source files
- `git diff --check`
## Caveat
This module has no test sources, and validation does not connect to a live
Cassandra cluster. The change is intentionally limited to an unused Cassandra
server-side YAML dependency.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
