8000 YARN-11389. Upgrade spring-core to 5.3.20 in wro4j-maven-plugin by dmmkr · Pull Request #5192 · apache/hadoop · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

YARN-11389. Upgrade spring-core to 5.3.20 in wro4j-maven-plugin #5192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: trunk
Choose a base branch
from
Open

YARN-11389. Upgrade spring-core to 5.3.20 in wro4j-maven-plugin #5192

wants to merge 1 commit into from
+10 −0

Conversation

dmmkr
Copy link
Contributor
@dmmkr dmmkr commented Dec 7, 2022 •
edited
Loading

Description of PR

How was this patch tested?

hadoop-yarn-ui build sucessful
No spring 3.1.1.RELEASE jars were downloaded during build.

For code changes:

  • Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?< 8000 /li>
  • Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
  • If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
  • If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

@dmmkr
Copy link
Contributor Author
dmmkr commented Dec 7, 2022

spring

@hadoop-yetus
Copy link

💔 -1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 37s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 1s codespell was not available.
+0 🆗 detsecrets 0m 1s detect-secrets was not available.
+0 🆗 xmllint 0m 1s xmllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
-1 ❌ test4tests 0m 0s The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
_ trunk Compile Tests _
+1 💚 mvninstall 38m 10s trunk passed
+1 💚 compile 3m 58s trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚 compile 3m 48s trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚 mvnsite 0m 43s trunk passed
+1 💚 javadoc 0m 34s trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚 javadoc 0m 23s trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚 shadedclient 67m 1s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 mvninstall 0m 15s the patch passed
+1 💚 compile 3m 23s the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚 javac 3m 23s the patch passed
+1 💚 compile 3m 39s the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚 javac 3m 39s the patch passed
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 mvnsite 0m 31s the patch passed
+1 💚 javadoc 0m 14s the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚 javadoc 0m 14s the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚 shadedclient 21m 5s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 unit 4m 30s hadoop-yarn-ui in the patch passed.
+1 💚 asflicense 0m 54s The patch does not generate ASF License warnings.
103m 21s
Subsystem Report/Notes
Docker ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5192/1/artifact/out/Dockerfile
GITHUB PR #5192
Optional Tests dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint
uname Linux 26147d56425b 4.15.0-200-generic #211-Ubuntu SMP Thu Nov 24 18:16:04 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 74817d0
Default Java Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions /usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5192/1/testReport/
Max. process+thread count 558 (vs. ulimit of 5500)
modules C: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui U: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5192/1/console
versions git=2.25.1 maven=3.6.3
Powered by Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

@steveloughran
Copy link
Contributor

i think the maven plugin itself should be upgraded, rather than trying to add new dependencies (and do the old ones get excluded? how do you guarantee the new ones get picked up?). what happens later when an upgrade does take place? will we remember to remove what may then be older dependencies

this is a compile time issue only, no cve in any redistributables, so hard to justify creating classpath/version hell for.

@dmmkr
Copy link
Contributor Author
dmmkr commented Dec 8, 2022

Thanks @steveloughran for the review,

I agree that spring version upgrade should come with the plugin, I tried upgrading the maven plugin to the latest available version of 1.10.1, it still has the vulnerable spring version of 5.3.1

I can a comment similar to #421 to ensure that the spring dependencies get removed in the later versions of plugin upgrade.

We are adding spring as the first level dependency for the plugin, whereas the existing spring is coming from the second level of dependency. Maven ensures that the nearest level of dependency gets picked up.

@brahmareddybattula
Copy link
Contributor

HI @steveloughran
As @dmmkr mentioned updated maven plugin doesn't fixed this and as handle on #421 this change should be ok.
Approach looks good to me now.
Please let me know your thoughts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@dmmkr @hadoop-yetus @steveloughran @brahmareddybattula
0