amaechler commented on code in PR #20790:
URL: https://github.com/apache/druid/pull/20790#discussion_r4430235501
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -163,7 +165,7 @@
<cve>CVE-2025-5115</cve> <!-- netty issue in shaded hadoop -->
</suppress>
- <suppress>
+ <suppress until="2027-04-30Z">
Review Comment:
Good catch, and it is wider than the comment says. Both
`hadoop-client-runtime-3.3.6` blocks have no `filePath` or `packageUrl`, so
they suppress their CVEs on every jar, not just Hadoop. Hadoop 3.3.6 is no
longer referenced by any `pom.xml` on master. Since every entry in them was
justified for a jar Druid no longer ships, I added `until="2027-01-31Z"` to
both blocks as a whole rather than splitting them (eb33692875). When they
lapse, anything that still fires gets a proper assessment against the jar it
actually matches. I'd rather not add a CI check for this: it would have to
infer "temporary" from comment wording, and the header note plus review covers
new entries.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
