HADOOP-18341: upgrade commons-configuration2 to 2.8.0 and commons-text to 1.9 #4578
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
ff2abff to
57994f8
Compare
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
3ab5aba to
7d200f9
Compare
|
🎊 +1 overall
This message was automatically generated. |
|
@ashutoshcipher would you be able to review this? - I've seen you've been busy working on other lib upgrades. This PR is only aimed at hadoop 3.4 and not something that needs to go to hadoop 3.3. |
|
Thanks @pjfanning. I can help in reviewing. My only concern here is that - As there is no security related issue or any major bug encountered in the current version. Is it worth upgrading - As sometimes some upgrades not being backward compatible makes the downstream projects using hadoop painful. |
|
Thanks @ashutoshcipher - thanks for looking. Just in case, this is from the issue description. Current version 2.1.1 has no CVEs but all higher versions have CVEs except for the latest release 2.8.0. Still feels like it would be safer to upgrade. The evidence so far appears that there are no breaking changes in commons-configuration2 and commons-text that would make this upgrade problematic. If you think this change is not worth the hassle it may cause to downstream projects, that's ok. |
|
Thanks @pjfanning for more explanation about this upgrade. Given
and
I am +1 for trunk. |
ashutoshcipher
approved these changes
Sep 19, 2022
|
Thanks for your PR and your discussion, @pjfanning and @ashutoshcipher. Our source code analyzer also detected CVE-2022-33980 in commons-configuration2-2.1.1. I do not think this vulnerability affects Hadoop, but we should upgrade it to 2.8.0. Some minor comments about this PR,
|
b1c5d13 to
e026f29
Compare
|
I've removed the change to TestTimelineWebServices. I also created #4916 |
upgrade commons-text because commons-configuration2 needs newer version Update TestTimelineWebServices.java Update TestTimelineWebServices.java
e026f29 to
82ac1a5
Compare
|
Thanks for updating the PR. +1, pending CI. I think the test is running. Let's wait and see. |
|
💔 -1 overall
This message was automatically generated. |
|
The failed tests seem not to be related to this PR. |
tasanuma
approved these changes
Sep 22, 2022
|
Merged it. Thanks for your contribution, @pjfanning. Thanks for your review, @ashutoshcipher. |
HarshitGupta11
pushed a commit
to HarshitGupta11/hadoop
that referenced
this pull request
Nov 28, 2022
…t to 1.9 (apache#4578) Reviewed-by: Ashutosh Gupta <ashugpt@amazon.com> Signed-off-by: Takanobu Asanuma <tasanuma@apache.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of PR
https://issues.apache.org/jira/browse/HADOOP-18341
How was this patch tested?
For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?