Commit c8cf394
[SPARK-45590][BUILD] Upgrade okio to 1.17.6 from 1.15.0
### What changes were proposed in this pull request?
This PR aims to upgrade `okio` from 1.15.0 to 1.17.6.
### Why are the changes needed?
Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635
Previous attempts to fix this security issue:
Update okio to version 1.17.6 #5587: fabric8io/kubernetes-client#5587
Followup to Update okio to version 1.17.6 #5935: fabric8io/kubernetes-client#5935
Unfortunately it is still using 1.15.0:
https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227
https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
No.
Closes #47758 from roczei/SPARK-45590.
Authored-by: Gabor Roczei <roczei@cloudera.com>
Signed-off-by: Kent Yao <yao@apache.org>1 parent d8bb37e commit c8cf394
2 files changed
+7
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
224 | 224 | | |
225 | 225 | | |
226 | 226 | | |
227 | | - | |
| 227 | + | |
228 | 228 | | |
229 | 229 | | |
230 | 230 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
231 | 231 | | |
232 | 232 | | |
233 | 233 | | |
| 234 | + | |
234 | 235 | | |
235 | 236 | | |
236 | 237 | | |
| |||
2872 | 2873 | | |
2873 | 2874 | | |
2874 | 2875 | | |
| 2876 | + | |
| 2877 | + | |
| 2878 | + | |
| 2879 | + | |
| 2880 | + | |
2875 | 2881 | | |
2876 | 2882 | | |
2877 | 2883 | | |
| |||
0 commit comments