arorasimran0309 commented on PR #6635:
URL: https://github.com/apache/hive/pull/6635#issuecomment-5291754902
@InvisibleProgrammer thanks for the review. Here are some of my observation
with respect to the discussion above.
1. About using jackson-bom, that is already in use. Even thought the CVEs
mentioned are jackson-databind specific, the target version upgrade is for all
**com.fasterxml.jackson.core** dependencies. For reference :
- <jackson.version>2.18.6</jackson.version>
+ <jackson.version>2.21.5</jackson.version>
]
and usage:
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
2. As for **com.fasterxml.jackson.core:jackson-annotations**, version number
2.21 is expected. It seems that is jackson versioning scheme and
jackson-annotations uses minor version. As mentioned in jackson-bom:2.21.5:
<jackson.version>2.21.5</jackson.version>
<jackson.version.annotations>2.21</jackson.version.annotations>
<jackson.version.core>${jackson.version}</jackson.version.core>
<jackson.version.databind>${jackson.version}</jackson.version.databind>
<jackson.version.dataformat>${jackson.version}</jackson.version.dataformat>
<jackson.version.datatype>${jackson.version}</jackson.version.datatype>
<jackson.version.jaxrs>${jackson.version}</jackson.version.jaxrs>...
3. The jackson-dependencies: 2.12.7.1 from hadoop-common:3.4.2 in
storage-api has scope **':provided'** , which implies its not included in the
final package (as seen above).
All packaged jars show 2.21.5/2.21 as verified by build artifacts.
storage-api is architecturally separate and doesn't inherit Hive's
dependency management by design.
for ref:
[HIVE-15419](https://gitlab.pic.es/bruzzese/hive/-/commit/0d045535d42c62b7521a73427365d875e40fead5?file_path=packaging%2Fpom.xml)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
