FrankChen021 opened a new pull request, #19808:
URL: https://github.com/apache/druid/pull/19808
## Summary
- remove the unused Jackson 1 version property and dependency-management
entries
- remove the explicit test-scope `jackson-core-asl` and `jackson-mapper-asl`
dependencies from `ambari-metrics-emitter`
- remove the now-obsolete OWASP suppression for `jackson-mapper-asl`
- retain the Ambari transitive exclusions that prevent Jackson 1 core/mapper
from entering the production dependency graph
## Root cause
Dependabot alerts #2 and #221 report
`org.codehaus.jackson:jackson-mapper-asl:1.9.13`. Jackson 1 is end-of-life and
has no patched release. The Ambari Metrics dependency already excluded Jackson
1 core and mapper from production, but the module explicitly added both
artifacts back in test scope. The root POM also kept global
dependency-management entries for them.
Druid's Ambari emitter source and tests use Jackson 2
(`com.fasterxml.jackson`), so the explicit Jackson 1 test dependencies are
unnecessary.
## Impact
The Ambari emitter no longer resolves `jackson-core-asl` or
`jackson-mapper-asl`, allowing Dependabot alerts #2 and #221 to close without
hiding an active vulnerable dependency. Runtime behavior is unchanged because
those artifacts were already excluded from the production Ambari dependency
path.
## Validation
- `mvn -ntp dependency:tree -pl extensions-contrib/ambari-metrics-emitter
-Dincludes=org.codehaus.jackson -Dverbose -Pskip-static-checks
-Dweb.console.skip=true -T1C`
- confirms neither `jackson-core-asl` nor `jackson-mapper-asl` is
resolved; Ambari's separate `jackson-xc` artifact remains
- `mvn -ntp test -pl extensions-contrib/ambari-metrics-emitter
-Pskip-static-checks -Dweb.console.skip=true -T1C`
- 28 tests passed
- `git diff --check`
## Caveats
This intentionally does not upgrade Ambari or alter its binary API. The
existing exclusions remain in place to prevent its transitive Jackson 1
core/mapper dependencies from returning.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
