Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependencies to fix vulnerabilities #13892

Merged
merged 1 commit into from
Aug 27, 2024

Conversation

Jackie-Jiang
Copy link
Contributor

@Jackie-Jiang Jackie-Jiang commented Aug 27, 2024

Upgraded/Pinned the following dependencies:

  • kotlin: 2.0.10 -> 2.0.20
  • dnsjava: 3.6.1
  • curator: 5.7.0
  • kryo: 2.24.0
  • objenesis: 3.4
  • chill: 0.10.0
  • HikariCP-java7: 2.4.13
  • ivy: 2.5.2
  • c3p0: 0.10.1
  • mchange-commons-java: 0.3.1

The vulnerabilities for the following dependencies are not fixed:

  • Kafka 2.8.2: Need to support Kafka 3
  • Spark 2.4.8: For backward compatibility (as plug-in, not used in production)

@Jackie-Jiang Jackie-Jiang added dependencies Pull requests that update a dependency file cleanup security labels Aug 27, 2024
@Jackie-Jiang Jackie-Jiang requested a review from xiangfu0 August 27, 2024 01:17
@codecov-commenter
Copy link

codecov-commenter commented Aug 27, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 57.51%. Comparing base (59551e4) to head (212f3d8).
Report is 946 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff              @@
##             master   #13892      +/-   ##
============================================
- Coverage     61.75%   57.51%   -4.24%     
+ Complexity      207      197      -10     
============================================
  Files          2436     2580     +144     
  Lines        133233   142450    +9217     
  Branches      20636    22117    +1481     
============================================
- Hits          82274    81929     -345     
- Misses        44911    54022    +9111     
- Partials       6048     6499     +451     
Flag Coverage Δ
custom-integration1 <0.01% <ø> (-0.01%) ⬇️
integration <0.01% <ø> (-0.01%) ⬇️
integration1 <0.01% <ø> (-0.01%) ⬇️
integration2 0.00% <ø> (ø)
java-11 57.48% <ø> (-4.23%) ⬇️
java-21 57.39% <ø> (-4.24%) ⬇️
skip-bytebuffers-false 57.51% <ø> (-4.24%) ⬇️
skip-bytebuffers-true 57.35% <ø> (+29.62%) ⬆️
temurin 57.51% <ø> (-4.24%) ⬇️
unittests 57.51% <ø> (-4.24%) ⬇️
unittests1 40.22% <ø> (-6.68%) ⬇️
unittests2 27.82% <ø> (+0.09%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@Jackie-Jiang Jackie-Jiang force-pushed the fix_vulnerabilities branch 2 times, most recently from 76ab3ed to 5cf7fce Compare August 27, 2024 03:33
@Jackie-Jiang Jackie-Jiang merged commit 64eb323 into apache:master Aug 27, 2024
22 of 23 checks passed
@Jackie-Jiang Jackie-Jiang deleted the fix_vulnerabilities branch August 27, 2024 21:48
rajagopr pushed a commit to rajagopr/pinot that referenced this pull request Sep 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cleanup dependencies Pull requests that update a dependency file security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants