Copilot commented on code in PR #19806:
URL: https://github.com/apache/druid/pull/19806#discussion_r3683814547
##########
extensions-contrib/cassandra-storage/pom.xml:
##########
@@ -129,6 +114,10 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.yaml</groupId>
+ <artifactId>snakeyaml</artifactId>
+ </exclusion>
Review Comment:
It’s not obvious from the POM alone why `snakeyaml` is being excluded here
(especially after removing the prior explanatory `dependencyManagement`
pin/comment). Consider adding a short XML comment above this exclusion
explaining that SnakeYAML is only used for Cassandra server-side YAML config
(not used by this extension), and that this exclusion is intentionally removing
an unused vulnerable transitive dependency to avoid pulling in an incompatible
major version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
