[
https://issues.apache.org/jira/browse/AMBARI-26653?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jialiang Cai updated AMBARI-26653:
----------------------------------
Description:
h2. Outcome
PR https://github.com/apache/ambari/pull/4208 contains 27 independently
implemented topic commits covering the five initial dependency fixes and all 26
remaining reviewed proposals. The latest validated commit is
ad88859fdbffa15680485a22fca42987cc8fe049. The work was implemented from current
source, not by applying bot patches.
h2. Changes
* Upgrade Commons BeanUtils, remove unused Jettison, align Commons Compress/IO,
update agent Commons Configuration and align Jackson 2.18.9.
* Patch the selected modern frontend dependency families across React, Admin
and Files View, including compatible Vite 6.4.3/Vitest 3.2.7 toolchains.
* Make Node 22.23.1 and Yarn 1.22.22 the canonical classic build, remove stale
duplicate dependency graphs and unused Express, and adapt/test the real Express
4 development server.
* Upgrade setuptools to 83.0.0 with hashed locks and a Python 3.10+ build
environment while retaining Python 3.9.2+ runtime support. Update installer,
Maven, Rocky 8 builder and Jenkins consumers.
* Upgrade H2 to 2.5.250 and c3p0 to 0.14.2, preserve SQL and pool behavior, and
update MariaDB/SQL Server test drivers to stable compatible versions.
* Align both Spring example views at Spring 6.2.19 and Jakarta Servlet 6;
verify dispatch, migration and WAR/JAR packaging.
* Migrate to Jetty 12.0.39 EE10 with real Spring WebSocket/JSP tests,
dynamic-view recovery, session/security checks and removal of unused legacy
HTTP artifacts from agent tools.
* Replace retired ApacheDS Kerberos libraries with Kerby 2.1.2 and Directory
API 2.1.5, preserving key derivation, keytabs, unsigned KVNO behavior and
protocol-level KDC probing.
h2. Validation
* Integrated source-reactor Java run: 751 tests, zero failures/errors, three
existing skips. Final agent runtime cleanup additionally passed all 15
credential/ZooKeeper tests.
* Final Spring examples and Views API reactor: 10 tests passed, deployable
WAR/JAR built.
* Python build, metadata and sdist tools: 51 tests passed; real Linux Python
3.9 runtime installation/imports, separate build/runtime interpreters and Rocky
8 builder verified.
* Modern frontend: React 1075 tests, Admin 223 tests plus coverage, Files View
12 tests; installs/builds and selected-family audits passed.
* Classic frontend: 22259 active tests passed with 662 existing skips; frozen
install, builds, routing/error/shutdown smoke and Maven packaging passed. Final
Node 22.23.1 integrated web package and smoke passed.
* Database: 341 ORM/DAO/entity tests without failures (two existing skips),
real MariaDB 10.11 DDL integration passed, JDBC URL/property contracts passed.
* Old-version BeanUtils, Jackson and c3p0 negative controls fail the intended
protection assertions; patched versions pass.
* Final dependency graphs and git diff checks passed. No obsolete
Jettison/ApacheDS Kerberos or Jetty 9/11/legacy Servlet artifacts remain in the
checked runtime graphs.
h2. Limits
SQL Server live integration is explicitly skipped on this ARM host because its
official container image is amd64-only; driver contracts and integration-test
compilation are verified. Existing frontend lint output is identical to the
untouched baseline. The empty Views API tar assembly required an explicit skip,
while actual example deployment artifacts were built. An exploratory
full-server sweep was interrupted and is not counted as passed. Unrelated
advisories outside the reviewed set, including server-transitive Configuration2
2.1.1, are documented in the PR. No repository-wide zero-vulnerability or
endpoint-exploitability claim is made.
Exact validation commands and further evidence are in the PR description.
Related bot proposals remain open until this PR is merged and trunk is verified.
was:
h2. Objective
Remediate the remaining applicable dependency findings in one PR,
https://github.com/apache/ambari/pull/4208, using independently implemented,
reviewable topic commits under AMBARI-26653. Dependabot proposals are evidence
of affected dependencies, not implementation patches to copy.
h2. Initial Remediation
The first five commits upgrade Commons BeanUtils, remove unused Jettison, align
Commons Compress and Commons IO, upgrade agent Commons Configuration, and align
Jackson 2.18.9. The focused combined Java lifecycle passed 66 tests and the
first PR revision passed Jenkins.
h2. Expanded Scope
# Modern frontend: patch Nanoid, Browserslist, HumanFS, Immutable and affected
brace-expansion copies; coordinate Files View Vitest/Vite/esbuild with
compatible React tooling. Regenerate native lockfiles and validate
installation, builds and tests. Covers #4190, #4191, #4192, #4193, #4194,
#4199, #4185 and relevant #4162 copies.
# Legacy frontend: independently resolve Express, tar, js-yaml and
brace-expansion in the actual classic build. Audit obsolete duplicate root
dependency graphs and unused packages before removing or updating them. Covers
#3594, #4109, #4157, #4162.
# Python build tooling: use patched setuptools and regenerate hashed build
locks. Separate its Python 3.10+ build prerequisite from Ambari's retained
Python 3.9.2+ runtime support, including source installation and packaged
artifacts. Covers #4200.
# Database runtime and test drivers: migrate H2 to a supported patched 2.x
release with SQL/ORM compatibility, upgrade c3p0 with connection and recovery
tests, and use stable compatible MariaDB and SQL Server drivers. Covers #3717,
#4156, #4183, #4083.
# Spring example views: replace isolated legacy Spring pins with a coherent
patched Spring 6.2 family, Jakarta Servlet APIs/descriptors, and
context/dispatch/data-migration tests. Covers #3609, #3610, #4020, #4022,
#4159, #4160, #4161.
# Jetty: migrate to a patched Jetty 12.0 EE10 family with Servlet 6,
coordinating artifact names, HTTP/HTTPS handlers, view/session behavior and
WebSocket lifecycle. Covers #4155.
# Kerberos: replace mutually incompatible retired ApacheDS Kerberos
client/codec APIs with maintained Apache Kerby, align Directory LDAP API, and
preserve KDC probing, key derivation, keytab format/merge/permissions and
authentication behavior. Covers #4196, #4197.
h2. Acceptance And Review
Use one PR with coherent topic commits and focused tests in the same commit.
Remain on JDK 17 and preserve Ambari runtime behavior. Verify real resolved
dependency graphs, supported API compatibility, failure/recovery paths and
packaged outputs. Each new topic requires its own exact validation evidence,
followed by integrated validation. Record existing test failures and platform
limitations explicitly. No final success for the expanded scope is claimed
while integration is in progress.
Dependency versions alone do not prove an exploitable Ambari endpoint. Broader
unrelated audit findings remain separately documented; this change covers the
enumerated open proposals and dependencies required for their safe remediation.
> Remediate vulnerable runtime and build dependencies
> ---------------------------------------------------
>
> Key: AMBARI-26653
> URL: https://issues.apache.org/jira/browse/AMBARI-26653
> Project: Ambari
> Issue Type: Bug
> Reporter: Jialiang Cai
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Outcome
> PR https://github.com/apache/ambari/pull/4208 contains 27 independently
> implemented topic commits covering the five initial dependency fixes and all
> 26 remaining reviewed proposals. The latest validated commit is
> ad88859fdbffa15680485a22fca42987cc8fe049. The work was implemented from
> current source, not by applying bot patches.
> h2. Changes
> * Upgrade Commons BeanUtils, remove unused Jettison, align Commons
> Compress/IO, update agent Commons Configuration and align Jackson 2.18.9.
> * Patch the selected modern frontend dependency families across React, Admin
> and Files View, including compatible Vite 6.4.3/Vitest 3.2.7 toolchains.
> * Make Node 22.23.1 and Yarn 1.22.22 the canonical classic build, remove
> stale duplicate dependency graphs and unused Express, and adapt/test the real
> Express 4 development server.
> * Upgrade setuptools to 83.0.0 with hashed locks and a Python 3.10+ build
> environment while retaining Python 3.9.2+ runtime support. Update installer,
> Maven, Rocky 8 builder and Jenkins consumers.
> * Upgrade H2 to 2.5.250 and c3p0 to 0.14.2, preserve SQL and pool behavior,
> and update MariaDB/SQL Server test drivers to stable compatible versions.
> * Align both Spring example views at Spring 6.2.19 and Jakarta Servlet 6;
> verify dispatch, migration and WAR/JAR packaging.
> * Migrate to Jetty 12.0.39 EE10 with real Spring WebSocket/JSP tests,
> dynamic-view recovery, session/security checks and removal of unused legacy
> HTTP artifacts from agent tools.
> * Replace retired ApacheDS Kerberos libraries with Kerby 2.1.2 and Directory
> API 2.1.5, preserving key derivation, keytabs, unsigned KVNO behavior and
> protocol-level KDC probing.
> h2. Validation
> * Integrated source-reactor Java run: 751 tests, zero failures/errors, three
> existing skips. Final agent runtime cleanup additionally passed all 15
> credential/ZooKeeper tests.
> * Final Spring examples and Views API reactor: 10 tests passed, deployable
> WAR/JAR built.
> * Python build, metadata and sdist tools: 51 tests passed; real Linux Python
> 3.9 runtime installation/imports, separate build/runtime interpreters and
> Rocky 8 builder verified.
> * Modern frontend: React 1075 tests, Admin 223 tests plus coverage, Files
> View 12 tests; installs/builds and selected-family audits passed.
> * Classic frontend: 22259 active tests passed with 662 existing skips; frozen
> install, builds, routing/error/shutdown smoke and Maven packaging passed.
> Final Node 22.23.1 integrated web package and smoke passed.
> * Database: 341 ORM/DAO/entity tests without failures (two existing skips),
> real MariaDB 10.11 DDL integration passed, JDBC URL/property contracts passed.
> * Old-version BeanUtils, Jackson and c3p0 negative controls fail the intended
> protection assertions; patched versions pass.
> * Final dependency graphs and git diff checks passed. No obsolete
> Jettison/ApacheDS Kerberos or Jetty 9/11/legacy Servlet artifacts remain in
> the checked runtime graphs.
> h2. Limits
> SQL Server live integration is explicitly skipped on this ARM host because
> its official container image is amd64-only; driver contracts and
> integration-test compilation are verified. Existing frontend lint output is
> identical to the untouched baseline. The empty Views API tar assembly
> required an explicit skip, while actual example deployment artifacts were
> built. An exploratory full-server sweep was interrupted and is not counted as
> passed. Unrelated advisories outside the reviewed set, including
> server-transitive Configuration2 2.1.1, are documented in the PR. No
> repository-wide zero-vulnerability or endpoint-exploitability claim is made.
> Exact validation commands and further evidence are in the PR description.
> Related bot proposals remain open until this PR is merged and trunk is
> verified.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
