Commit 6616025
ODP-3237: [SPARK-45590][BUILD] Upgrade okio to 1.17.6 from 1.15.0
This PR aims to upgrade `okio` from 1.15.0 to 1.17.6.
Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635
Previous attempts to fix this security issue:
Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587
Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935
Unfortunately it is still using 1.15.0:
https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227
https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210
No.
Pass the CIs.
No.
Closes apache#47758 from roczei/SPARK-45590.
Authored-by: Gabor Roczei <roczei@cloudera.com>
Signed-off-by: Kent Yao <yao@apache.org>
(cherry picked from commit c8cf394)1 parent 826b869 commit 6616025
1 file changed
+6
-0
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
241 | 241 | | |
242 | 242 | | |
243 | 243 | | |
| 244 | + | |
244 | 245 | | |
245 | 246 | | |
246 | 247 | | |
| |||
2792 | 2793 | | |
2793 | 2794 | | |
2794 | 2795 | | |
| 2796 | + | |
| 2797 | + | |
| 2798 | + | |
| 2799 | + | |
| 2800 | + | |
2795 | 2801 | | |
2796 | 2802 | | |
2797 | 2803 | | |
| |||
0 commit comments