-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixing high severity CVEs in pinot-adls/pinot-orc/pinot-parquet #12571
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -70,5 +70,9 @@ | |
<artifactId>xml-apis</artifactId> | ||
<scope>compile</scope> | ||
</dependency> | ||
<dependency> | ||
<groupId>com.google.protobuf</groupId> | ||
<artifactId>protobuf-java</artifactId> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We should set this in the dependency management section of the root pom. That way it will be enforced for any transitive dependency There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It is defined in root pom. However the shading packages another version, so need to explicitly set it here. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I don't understand why that is happening, but lets merge it as it is suggested here. |
||
</dependency> | ||
</dependencies> | ||
</project> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@xiangfu0 We have noticed that by overriding the version within this module, this creates a discrepancy in versions relative to any shaded jars (1.0.7.Final in the shaded jar vs 1.1.3.Final here), breaking our internal build. This discrepancy is not ideal as it would be preferable to manage the dependencies centrally from the root pom's dependency management section as suggested by @gortiz This also opens up the door to folks that need to override dependency versions in their builds for compliance reasons.
Given the above, would it be possible to move the version settings to dependencyManagement in the root pom?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#12597