-
Notifications
You must be signed in to change notification settings - Fork 3.4k
HBASE-28250 Bump jruby to 9.4.8.0 to fix snakeyaml CVE #6127
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Please see https://issues.apache.org/jira/browse/HBASE-28250 for RCA |
This is good for review, except licensing changes, if any, need to analyse! |
@@ -859,7 +859,7 @@ | |||
<wx.rs.api.version>2.1.1</wx.rs.api.version> | |||
<glassfish.jsp.version>2.3.2</glassfish.jsp.version> | |||
<glassfish.el.version>3.0.1-b08</glassfish.el.version> | |||
<jruby.version>9.3.13.0</jruby.version> | |||
<jruby.version>9.4.8.0</jruby.version> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
jcoding and joni changes were not needed, hence no change around that here
🎊 +1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
Just verified, we do not need any licensing changes as apparently ruby licensing is already in place: https://github.com/ruby/irb/blob/v1.4.2/LICENSE.txt is already there in our LICENSE.txt: Line 617 in 836f2d9
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not a ruby expert but since all UTs are passed, I think it is OK.
Please fix the whilespace issue and also open a PR against branch-2.
Thanks.
Hi just updating how I have been testing out this version bump. First, curated a list of tests based on basic sanity + old JIRAs which were created post version bump. (Plan to automate these for future releases soon) Following are the things i have tested:
Based on point 12 and 14, I suggest to disable colorize and auto_complete which are by default enabled in JRuby 9.4.8.0 and is very buggy Or we could document steps on how to disable it via .irbrc. I will update PR based on how others feel.
Based on point 11, we may need to add removal of import for custom ruby scripts in release notes. Please let me know if I have missed any cases, and should test anything else. |
The previous indent was incorrect, this line indent is as per copied line https://github.com/ruby/irb/blob/f9960dbd370769addca04dda4f1a06d921a4e98d/lib/irb.rb#L461C8-L461C43
Which all branches should we target? Just branch-2 right? Also just wanted to call out again Anyways I have tested my changes on 2.6.0 itself and all work good as shared in previous comment! |
Thanks for the thorough testing here. This looks very promising! Re: autocomplete and colors, can we disable them by default and document how to reenable them for the brave? |
Should this PR also update all the internal rb scripts to use |
Hi Nick thanks for taking time to review this PR.
I can think of two approaches to implement same:
I have tried our internal ruby scripts: Also I did a quick check with following command: |
Going ahead to implement and update PR with approach 1. |
🎊 +1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
Ping @ndimiduk could you please see if commit 2 addresses your review comment |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice one, thanks @NihalJain
* Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4)
Yes I think that this can go to branch-2 as well. |
* Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4)
Raised backport for branch-2 as well. May be will request others to add approval on #6146 before we merge that into codebase. |
* Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4)
* Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4)
…pache#6127) (apache#6146) * Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4) (cherry picked from commit d94def3) Change-Id: I978dd2d835534911ca7138f54e58728349a7403f
…pache#6146) * Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4) (cherry picked from commit d94def3)
…ml CVE (apache#6127) (apache#6146) * Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4) (cherry picked from commit d94def3) (cherry picked from commit a6d54eb) Change-Id: I8fcdfe5dedf4afef870289bed13afaba7e8c111a
* Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org>
…pache#6146) * Sync code as per irb 1.4.2 * Also provide option to try irb's new functionalities for colorize and autocomplete Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Nick Dimiduk <ndimiduk@apache.org> (cherry picked from commit 6788ff4)
No description provided.