[
https://issues.apache.org/jira/browse/OOZIE-3650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17478737#comment-17478737
]
PJ Fanning commented on OOZIE-3650:
-----------------------------------
I'm off hiking today so can only send a short message by phone. There is a 004
patch file that has a separate version num for jackson databind. Could you be
looking at 003 patch?
Sent from Yahoo Mail on Android
On Wed, 19 Jan 2022 at 13:50, Andras Salamon (Jira)<[email protected]> wrote:
[
https://issues.apache.org/jira/browse/OOZIE-3650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17478652#comment-17478652
]
Andras Salamon commented on OOZIE-3650:
---------------------------------------
Spotbugs give us false errors, I think we can ignore that.
I tried to compile Oozie with this patch, but it failed because it was not able
to download jackson-annotations:jar:2.6.7.5 and jackson-core:jar:2.6.7.5. And
those versions are really not available:
* [https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core]
*
[https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-annotations]
*
[https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind]
Only jackson-databind has version 2.6.7.5 the others have only version 2.6.7
In the pom.xml we try to use the same version everywhere:
{noformat}
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-scala_${spark.scala.binary.version}</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency> {noformat}
I think we need two versions here, one for jackson in general (2.6.7) and one
for the jackson-databing (2.6.7.5).
I don't really understand how is it possible that compilation was working in
pre-commit and also for you.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
> upgrade jackson - ideally to v2.13.1
> ------------------------------------
>
> Key: OOZIE-3650
> URL: https://issues.apache.org/jira/browse/OOZIE-3650
> Project: Oozie
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
> Labels: patch-available
> Attachments: OOZIE-3650-003.patch, OOZIE-3650-004.patch
>
>
> Oozie currently has a dependency on an old version of Jackson (2.6.5) -
> [https://github.com/apache/oozie/blob/master/pom.xml#L119]
> There are a number of CVEs open affecting this version.
> https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.6.5
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
