deepakpanda93 commented on issue #16027:
URL: https://github.com/apache/hudi/issues/16027#issuecomment-5177790063
This issue was reviewed as part of the JIRA-migrated backlog triage.
Findings: the Pulsar upgrade requested here has already landed, via two
merged commits that superseded the linked PR #8973 (which was marked [DO NOT
MERGE] and closed unmerged on 2024-03-10):
- #9670 — `[HUDI-6845] Upgrade org.apache.pulsar:pulsar-client to 2.10.2`,
merged 2023-09-11 (commit `ce96d5da3e3e`): `pulsar.version` 2.8.1 → 2.10.2
- #10223 — `[HUDI-7338] Bump HBase, Pulsar, Jetty version`, merged
2024-02-06 (commit `c1d47014ca04`): `pulsar.version` 2.10.2 → 3.0.2
Reading `pom.xml` at the release tags, **0.15.0** is the first release
carrying `pulsar.version` 3.0.2; 0.14.0 and 0.14.1 still had 2.8.1. It remains
3.0.2 on `master` and on release-1.0.0, 1.1.0 and 1.2.0, and was never
reverted. That is
well past the 2.10.0 this issue's patch proposed.
One caveat on the CVE-2022-1471 motivation:
`dependencies/hudi-integ-test-bundle.txt` still resolves `snakeyaml 1.15`. That
bundle contains no Pulsar jar, so the remaining snakeyaml comes in via the
Hadoop/Hive/Spark stack rather than Pulsar. The Pulsar → snakeyaml path
described in this issue is gone; if the residual snakeyaml 1.15 is still a
concern, it is worth its own ticket.
If you're still hitting a Pulsar-related dependency problem on a recent
version, please reopen with details.
Closing as fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
