geyanggang opened a new pull request, #11269:
URL: https://github.com/apache/gravitino/pull/11269
### What changes were proposed in this pull request?
- Add the global `constraints {
implementation("org.xerial.snappy:snappy-java:$snappyJavaVersion") }` from the
root `build.gradle.kts` file.
- Also add the temporary `val snappyJavaVersion = "1.1.10.8"` defined at the
top of the root build script.
- The necessary version upgrade is already enforced in
`:catalogs:hive-metastore2-libs` and `:catalogs:hive-metastore3-libs` via PR
#11085 (`implementation(libs.snappy.java)` in their `constraints` block).
### Why are the changes needed?
- The global constraint forces `snappy-java` 1.1.10.8 on **all**
subprojects, even those that do not transitively depend on the vulnerable Hive
Metastore version.
- This is unnecessary and may introduce unintended side effects or conflicts.
- The original issue (#11084) only required fixing the Hive Metastore
library modules.
Fix: #11084
### Does this PR introduce _any_ user-facing change?
(Please list the user-facing changes introduced by your change, including
1. Change in user-facing APIs.
2. Addition or removal of property keys.)
### How was this patch tested?
(Please test your changes, and provide instructions on how to test it:
- Ensured all modules still show `1.1.8.2 -> 1.1.10.8` in dependency insight.
=== :authorizations:authorization-ranger ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :bundles:aliyun-bundle ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :bundles:aws-bundle ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :bundles:azure-bundle ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :bundles:gcp-bundle ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :catalogs:catalog-fileset ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :catalogs:catalog-kafka ===
org.xerial.snappy:snappy-java:1.1.8.4 -> 1.1.10.8
=== :catalogs:catalog-lakehouse-iceberg ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :catalogs:catalog-lakehouse-paimon ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :catalogs:hadoop-common ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :catalogs:hive-metastore2-libs ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :catalogs:hive-metastore3-libs ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :iceberg:iceberg-common ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
=== :iceberg:iceberg-rest-server ===
org.xerial.snappy:snappy-java:1.1.8.2 -> 1.1.10.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
