JinwooHwang commented on code in PR #8140:
URL: https://github.com/apache/geode/pull/8140#discussion_r4401086604
##########
build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy:
##########
@@ -201,6 +203,10 @@ class DependencyConstraints {
api(group: 'org.bouncycastle', name: 'bcprov-jdk18on', version:
get('bouncycastle.version'))
// GEODE-10681: Pin hibernate-validator to a fixed version
api(group: 'org.hibernate.validator', name: 'hibernate-validator',
version: get('hibernate-validator.version'))
+ // GEODE-10687: Pin ASM (transitive via Jetty) to a fixed version
Review Comment:
Thanks for the quick and thorough review, @utafrali! I really appreciate you
checking that the pin follows the same pattern as bouncycastle and
hibernate-validator, and confirming that ASM's BSD-3-Clause license is ASF
Category A. I've ticked that checkbox.
Good catch on `asm-analysis` and `asm-util`. Today only `asm`,
`asm-commons`, and `asm-tree` reach the classpath through Jetty, so those are
the ones pinned. You're right that a future Jetty upgrade could quietly bring
in the others. I'll add a note to GEODE-10687 so whoever does the next ASM bump
checks those modules too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
