[
https://issues.apache.org/jira/browse/HADOOP-18496?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17626863#comment-17626863
]
ASF GitHub Bot commented on HADOOP-18496:
-----------------------------------------
steveloughran commented on code in PR #5035:
URL: https://github.com/apache/hadoop/pull/5035#discussion_r1009899456
##########
hadoop-common-project/hadoop-common/pom.xml:
##########
@@ -382,6 +382,21 @@
<groupId>com.squareup.okhttp3</groupId>
<artifactId>mockwebserver</artifactId>
<scope>test</scope>
+ <exclusions>
Review Comment:
don't these exclusions get picked up from the hadoop project declaration
##########
LICENSE-binary:
##########
@@ -241,8 +241,9 @@ com.google.guava:guava:27.0-jre
com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
com.microsoft.azure:azure-storage:7.0.0
com.nimbusds:nimbus-jose-jwt:9.8.1
-com.squareup.okhttp3:okhttp:4.9.3
+com.squareup.okhttp3:okhttp:4.10.0
com.squareup.okio:okio:1.6.0
+com.squareup.okio:okio:3.2.0
Review Comment:
does the one above need cutting?
> upgrade kotlin-stdlib due to CVEs
> ---------------------------------
>
> Key: HADOOP-18496
> URL: https://issues.apache.org/jira/browse/HADOOP-18496
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
> Labels: pull-request-available
>
> I'm not an expert on Kotlin but dependabot show these 2 CVEs with the version
> of kotlin-stdlib used in Hadoop.
> * [https://github.com/advisories/GHSA-cqj8-47ch-rvvq]
> * [https://github.com/advisories/GHSA-2qp4-g3q3-f92w]
> kotlin-stlib 1.6.0 is the minimum version needed to fix both. It might be
> better to use latest v1.6 jar (currently 1.6.21) or even use latest jar
> altogether (currently 1.7.20).
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
