zabetak opened a new pull request, #6929: URL: https://github.com/apache/hive/pull/6929
### Why are the changes needed? The json-path dependency is coming from Calcite and its only used by the respective code. Pinning down the json-path version to 2.9.0 in Hive leads to version misalignment since the current version of Calcite uses json-path 2.10.0. A side-effect of the version pindown is to get stack with obsolete and insecure transitive depenencies, such as json-smart:2.5.0, that are not even used in Hive. In order to avoid version inconsistencies and inclusion of obsolete and insecure deps in the Hive runtime we opt to bundle the json-path dependency in the shaded jar. This ensures the correct json-path (as defined by Calcite) is used at runtime while its unused transitive dependencies (json-smart, accessors-smart) are dropped from the dependency tree. ### Does this PR introduce _any_ user-facing change? No ### How was this patch tested? Existing tests and by checking dependency tree output. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
