Fixing high severity CVEs in pinot-adls/pinot-orc/pinot-parquet #12571
Conversation
| @@ -70,5 +70,9 @@ | |||
| <artifactId>xml-apis</artifactId> | |||
| <scope>compile</scope> | |||
| </dependency> | |||
| <dependency> | |||
| <groupId>com.google.protobuf</groupId> | |||
| <artifactId>protobuf-java</artifactId> | |||
There was a problem hiding this comment.
We should set this in the dependency management section of the root pom. That way it will be enforced for any transitive dependency
There was a problem hiding this comment.
It is defined in root pom. However the shading packages another version, so need to explicitly set it here.
There was a problem hiding this comment.
I don't understand why that is happening, but lets merge it as it is suggested here.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #12571 +/- ##
============================================
- Coverage 61.75% 61.57% -0.18%
Complexity 207 207
============================================
Files 2436 2451 +15
Lines 133233 133732 +499
Branches 20636 20704 +68
============================================
+ Hits 82274 82347 +73
- Misses 44911 45280 +369
- Partials 6048 6105 +57
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| <dependency> | ||
| <groupId>org.wildfly.openssl</groupId> | ||
| <artifactId>wildfly-openssl</artifactId> | ||
| <version>${wildfly-openssl.version}</version> |
There was a problem hiding this comment.
@xiangfu0 We have noticed that by overriding the version within this module, this creates a discrepancy in versions relative to any shaded jars (1.0.7.Final in the shaded jar vs 1.1.3.Final here), breaking our internal build. This discrepancy is not ideal as it would be preferable to manage the dependencies centrally from the root pom's dependency management section as suggested by @gortiz This also opens up the door to folks that need to override dependency versions in their builds for compliance reasons.
Given the above, would it be possible to move the version settings to dependencyManagement in the root pom?
net.minidev:json-smartto version 2.5.0 to fix CVE-2023-1370org.wildfly.openssl:wildfly-opensslto version 1.1.3.Final to fix CVE-2020-25644org.wildfly.openssl:wildfly-openssl-javato version 1.1.3.Final to fix CVE-2020-25644com.google.protobuf:protobuf-javaversion 3.25.2 to pinot-orc pom filecom.google.protobuf:protobuf-javaversion 3.25.2 to pinot-parquet pom file