Guosmilesmile commented on code in PR #17336:
URL: https://github.com/apache/iceberg/pull/17336#discussion_r3642771783
##########
spark/v3.5/build.gradle:
##########
@@ -30,9 +30,9 @@ configure(sparkProjects) {
configurations {
all {
resolutionStrategy {
- force
"com.fasterxml.jackson.module:jackson-module-scala_${scalaVersion}:${libs.versions.jackson215.get()}"
- force
"com.fasterxml.jackson.core:jackson-databind:${libs.versions.jackson215.get()}"
- force
"com.fasterxml.jackson.core:jackson-core:${libs.versions.jackson215.get()}"
+ force
"com.fasterxml.jackson.module:jackson-module-scala_${scalaVersion}:${libs.versions.jackson221.get()}"
+ force
"com.fasterxml.jackson.core:jackson-databind:${libs.versions.jackson221.get()}"
+ force
"com.fasterxml.jackson.core:jackson-core:${libs.versions.jackson221.get()}"
Review Comment:
This PR was originally meant to fix the CVEs for both Kafka and Spark
together. The Kafka part has already been merged. As for the Spark part, I feel
that if we can fix the vulnerability by bumping the jar version, that might be
a cleaner approach than just suppressing it in spark-runtime-3.5.trivyignore.
That said, I'm happy to go with whatever the majority thinks is best here :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
