Update `okio` to version 1.17.6 #5587

bjornjorgensen · 2023-11-14T11:58:59Z

Description

This is a PR to fix CVE-2023-3635
The patch has been backported to branch 1.x thru square/okio#1334

fix #5485

Type of change

Bug fix (non-breaking change which fixes an issue)
Feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change
Chore (non-breaking change which doesn't affect codebase;
test, version modification, documentation, etc.)

Checklist

Code contributed by me aligns with current project license: Apache 2.0
I Added CHANGELOG entry regarding this change
I have implemented unit tests to cover my changes
I have added/updated the javadocs and other documentation accordingly
No new bugs, code smells, etc. in SonarCloud report
I tested my code in Kubernetes
I tested my code in OpenShift

sunix · 2023-11-24T11:34:48Z

@bjornjorgensen I have rebased your branch, let me know if it's an issue

sonarqubecloud · 2023-11-24T12:36:25Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

The version of Java (11.0.21) you have used to run this analysis is deprecated and we will stop accepting it soon. Please update to at least Java 17.
Read more here

bjornjorgensen · 2023-12-12T10:42:26Z

@manusa is this PR ok?

oscerd · 2023-12-12T10:43:15Z

LGTM @manusa

manusa · 2023-12-12T11:02:46Z

The PR is OK, we can merge it for now.

However, the overall idea is to get rid of the dependency: #5632

### What changes were proposed in this pull request? Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) ### Why are the changes needed? [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA ### Was this patch authored or co-authored using generative AI tooling? No. Closes #44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com>

bjornjorgensen · 2024-04-22T16:27:59Z

Hi, we are checking apache spark now hoping to have a new version 4.0.
According to SNYK

This PR diden't help that mutch

okhttp-3.12.12 does load okio 1.15.0 https://github.com/square/okhttp/blob/05e4ceef3f2aa117b42fa2db3fc79d58c53b7704/pom.xml#L59

even okhttp 3.14.9 https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp/3.14.9 have this CVE

@swankjesse any planes to update okhttp version 3.12.X ?

@dongjoon-hyun FYI

rohanKanojia · 2024-04-22T16:33:13Z

@bjornjorgensen : KubernetesClient offers alternatives to switching underlying HTTPClient . You can exclude io.fabric8:kubernetes-httpclient-okhttp dependency and use io.fabric8:kubernetes-httpclient-jdk, io.fabric8:kubernetes-httpclient-vertx or io.fabric8:kubernetes-httpclient-jetty.

For more information, please see https://github.com/fabric8io/kubernetes-client/blob/main/doc/MIGRATION-v6.md#apiimpl-split

What changes were proposed in this pull request? This PR aims to upgrade okio from 1.15.0 to 1.17.6. Why are the changes needed? Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 Does this PR introduce any user-facing change? No. How was this patch tested? Pass the CIs. Was this patch authored or co-authored using generative AI tooling? No.

### What changes were proposed in this pull request? This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. ### Why are the changes needed? Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 #5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 #5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org>

Backport apache#47758 to 3.5 This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394)

Backport apache#47758 to 3.4 This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394)

Backport #47758 to 3.5 ### What changes were proposed in this pull request? This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. ### Why are the changes needed? Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 #5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 #5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #47769 from roczei/roczei/SPARK-45590-branch-3.5. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org>

Backport #47758 to 3.4 ### What changes were proposed in this pull request? This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. ### Why are the changes needed? Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 #5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 #5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #47770 from roczei/SPARK-45590-branch-3.4. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org>

Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c)

This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394)

…t in spark (#66) * ODP-3237: Fix compile * [SPARK-44537][BUILD] Upgrade kubernetes-client to 6.8.0 The pr aims to upgrade kubernetes-client from 6.7.2 to 6.8.0. - The newest version brings some bug fixed & improvment, eg: Fix fabric8io/kubernetes-client#5221: Empty kube config file causes NPE Fix fabric8io/kubernetes-client#5281: Ensure the KubernetesCrudDispatcher's backing map is accessed w/lock Fix fabric8io/kubernetes-client#5298: Prevent requests needing authentication from causing a 403 response Fix fabric8io/kubernetes-client#5233: Generalized SchemaSwap to allow for cycle expansion Fix fabric8io/kubernetes-client#5262: all built-in collections will omit empty in their serialized form. - The full release notes: https://github.com/fabric8io/kubernetes-client/releases/ No. Pass GA. Closes apache#42142 from panbingkun/SPARK-44537. Authored-by: panbingkun <pbk1982@gmail.com> Signed-off-by: Dongjoon Hyun <dongjoon@apache.org> (cherry picked from commit 6b6216c) * [SPARK-44821][BUILD][K8S] Upgrade `kubernetes-client` to 6.8.1 ### What changes were proposed in this pull request? This PR aims to upgrade kubernetes-client to 6.8.1 ### Why are the changes needed? To bring two additional bug fixes. - https://github.com/fabric8io/kubernetes-client/releases/tag/v6.8.1 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. Closes apache#42505 from dongjoon-hyun/SPARK-44821. Authored-by: Dongjoon Hyun <dongjoon@apache.org> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit e25a654) * [SPARK-45465][BUILD][K8S] Upgrade `kubernetes-client` to 6.9.0 for K8s 1.28 This PR aims to upgrade `kubernetes-client` to 6.9.0 for K8s 1.28. `kubernetes-client` 6.9.0 includes new features and bug fixes on top of K8s 1.23 model. - https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.0 - fabric8io/kubernetes-client#5401 No. Pass the CIs. No. Closes apache#43284 from dongjoon-hyun/SPARK-45465. Authored-by: Dongjoon Hyun <dhyun@apple.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit 89acebb) * [SPARK-45728][BUILD][K8S] Upgrade `kubernetes-client` to 6.9.1 ### What changes were proposed in this pull request? This PR aims to upgrade `kubernetes-client` to 6.9.1. ### Why are the changes needed? This will bring us the following bug fixes including the CRD generator fix. - https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.1 - Fix fabric8io/kubernetes-client#5501: (crd-generator) Fix fallback value of Default annotation in presence of multiple accessors ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#43589 from dongjoon-hyun/SPARK-45728. Authored-by: Dongjoon Hyun <dhyun@apple.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit 311602a) * [SPARK-46662][K8S][BUILD] Upgrade `kubernetes-client` to 6.10.0 Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c) * [SPARK-47550][K8S][BUILD] Update `kubernetes-client` to 6.11.0 ### What changes were proposed in this pull request? Update `kubernetes-client` from 6.10.0 to 6.11.0 ### Why are the changes needed? [Release notes for 6.11.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.11.0) ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#45707 from bjornjorgensen/kub-client6.11.0. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit 7b9b3cb) * [SPARK-47860][BUILD][K8S] Upgrade `kubernetes-client` to 6.12.0 ### What changes were proposed in this pull request? This PR aims to upgrade `kubernetes-client` to 6.12.0. ### Why are the changes needed? To bring the latest bug fixes. - https://github.com/fabric8io/kubernetes-client/releases/tag/v6.12.0 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#46066 from dongjoon-hyun/SPARK-47860. Authored-by: Dongjoon Hyun <dhyun@apple.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit becbca6) * [SPARK-47915][BUILD][K8S] Upgrade `kubernetes-client` to 6.12.1 ### What changes were proposed in this pull request? Upgrade `kubernetes-client` from 6.12.0 to 6.12.1 ### Why are the changes needed? [Release notes](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.12.1) ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#46137 from bjornjorgensen/kub-client6.12.1. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit 8aa8ad6) * [SPARK-48514][BUILD][K8S] Upgrade `kubernetes-client` to 6.13.0 ### What changes were proposed in this pull request? Upgrade kubernetes-client from 6.12.1 to 6.13.0 ### Why are the changes needed? Upgrade Fabric8 Kubernetes Model to Kubernetes v1.30.0 [Release log 6.13.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.13.0) ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#46854 from bjornjorgensen/kubclient6.13.0. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit 6475ddf) * [SPARK-48801][BUILD][K8S] Upgrade `kubernetes-client` to 6.13.1 ### What changes were proposed in this pull request? The pr aims to upgrade `kubernetes-client` from `6.13.0` to `6.13.1`. ### Why are the changes needed? - The full release notes: https://github.com/fabric8io/kubernetes-client/releases/tag/v6.13.1 - The newest version fixed some bug, eg: Fix fabric8io/kubernetes-client#6059: Swallow rejected execution from internal usage of the informer executor Fix fabric8io/kubernetes-client#6068: KubernetesMockServer provides incomplete Configuration while creating test Config for KubernetesClient Fix fabric8io/kubernetes-client#6085: model getters have same annotations as fields (breaks native) ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#47206 from panbingkun/SPARK-48801. Authored-by: panbingkun <panbingkun@baidu.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit 5b00786) * [SPARK-49196][BUILD] Upgrade `kubernetes-client` to 6.13.2 ### What changes were proposed in this pull request? The pr aims to upgrade `kubernetes-client` from `6.13.1` to `6.13.2`. ### Why are the changes needed? - The full release notes: https://github.com/fabric8io/kubernetes-client/releases/tag/v6.13.2 - The newest version fixed some bug, eg: Fix fabric8io/kubernetes-client#6066: Added support for missing v1.APIVersions in KubernetesClient Fix fabric8io/kubernetes-client#6110: VolumeSource (and other file mode fields) in Octal are correctly interpreted Fix fabric8io/kubernetes-client#6137: ConfigBuilder.withAutoConfigure is not working ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#47703 from panbingkun/SPARK-49196. Authored-by: panbingkun <panbingkun@baidu.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit d09e1c5) * [SPARK-45590][BUILD] Upgrade okio to 1.17.6 from 1.15.0 This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394) * [SPARK-49255][BUILD][K8S] Upgrade `kubernetes-client` to 6.13.3 ### What changes were proposed in this pull request? This PR aims to upgrade `kubernetes-client` to 6.13.3. ### Why are the changes needed? Unfortunately, there is an important bug fix after we upgraded to 6.13.2. This PR aims to bring the fix. - https://github.com/fabric8io/kubernetes-client/releases/tag/v6.13.3 - fabric8io/kubernetes-client#6249 - fabric8io/kubernetes-client@1a66228 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#47782 from dongjoon-hyun/SPARK-49255. Authored-by: Dongjoon Hyun <dhyun@apple.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit 7a670d7) * [SPARK-49800][BUILD][K8S] Upgrade `kubernetes-client` to 6.13.4 ### What changes were proposed in this pull request? Upgrade `kubernetes-client` from 6.13.3 to 6.13.4 ### Why are the changes needed? New version that have 5 fixes [Release log 6.13.4](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.13.4) ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#48268 from bjornjorgensen/k8sclient6.13.4. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dongjoon@apache.org> (cherry picked from commit 54e62a1) * [SPARK-50493][SPARK-37687][BUILD] Migrate kubernetes-client from `6.x` to `7.x` The pr aims to migrate kubernetes-client from `6.x` to `7.x`, includes: - upgrade `kubernetes-client` from `6.13.2` to `7.0.1`. - switch default `HttpClient` implementation from `OkHttp` to `Vert.x`. - The full release notes: https://github.com/fabric8io/kubernetes-client/releases/tag/v7.0.1 https://github.com/fabric8io/kubernetes-client/releases/tag/v7.0.0 - [Vert.x as default HttpClient implementation](https://github.com/fabric8io/kubernetes-client/blob/v7.0.0/doc/MIGRATION-v7.md#vertx-as-default-httpclient-implementation-) No. Pass GA. No. Closes apache#49159 from panbingkun/k8s_client_7_vert_x. Authored-by: panbingkun <panbingkun@apache.org> Signed-off-by: Dongjoon Hyun <dongjoon@apache.org> (cherry picked from commit dccb129) --------- Co-authored-by: panbingkun <pbk1982@gmail.com> Co-authored-by: Dongjoon Hyun <dongjoon@apache.org> Co-authored-by: Dongjoon Hyun <dhyun@apple.com> Co-authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Co-authored-by: panbingkun <panbingkun@baidu.com> Co-authored-by: Gabor Roczei <roczei@cloudera.com> Co-authored-by: panbingkun <panbingkun@apache.org>

Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c)

This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394)

…10.0 Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c)

This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394)

…10.0 Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c) (cherry picked from commit 4fe602b)

This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394) (cherry picked from commit 6616025)

…10.0 Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c) (cherry picked from commit 4fe602b)

This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394) (cherry picked from commit 6616025)

…10.0 Upgrade `kubernetes-client` from 6.9.1 to 6.10.0 [Release notes 6.10.0](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.10.0) [Release notes 6.9.2](https://github.com/fabric8io/kubernetes-client/releases/tag/v6.9.2) [Updated okio to version 1.17.6 to avoid CVE-2023-3635](fabric8io/kubernetes-client#5587) [Upgrade Kubernetes Model to Kubernetes v1.29.0](fabric8io/kubernetes-client#5686) No. Pass GA No. Closes apache#44672 from bjornjorgensen/kubclient6.10. Authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com> Signed-off-by: Dongjoon Hyun <dhyun@apple.com> (cherry picked from commit dcfd37c) (cherry picked from commit 4fe602b)

) Backport apache#47758 to 3.5 This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47769 from roczei/roczei/SPARK-45590-branch-3.5. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> Co-authored-by: Gabor Roczei <roczei@cloudera.com>

bjornjorgensen requested review from manusa, oscerd, rohanKanojia, shawkins and sunix as code owners November 14, 2023 11:59

oscerd approved these changes Nov 14, 2023

View reviewed changes

bjornjorgensen added 2 commits November 24, 2023 12:33

1.

f28ee64

update changelog.md

5b5570c

sunix force-pushed the oki-1.17.6 branch from a3f77cf to 5b5570c Compare November 24, 2023 11:33

sunix approved these changes Nov 24, 2023

View reviewed changes

manusa approved these changes Dec 12, 2023

View reviewed changes

manusa added this to the 6.10.0 milestone Dec 12, 2023

manusa merged commit 9aacb48 into fabric8io:main Dec 12, 2023

bjornjorgensen deleted the oki-1.17.6 branch December 12, 2023 11:07

bjornjorgensen mentioned this pull request Jan 10, 2024

[SPARK-46662][K8S][BUILD] Upgrade kubernetes-client to 6.10.0 apache/spark#44672

Closed

bjornjorgensen mentioned this pull request Apr 22, 2024

Followup to Update okio to version 1.17.6 #5935

Merged

11 tasks

roczei mentioned this pull request Aug 14, 2024

[SPARK-45590][BUILD] Upgrade okio to 1.17.6 from 1.15.0 apache/spark#47758

Closed

roczei mentioned this pull request Aug 15, 2024

[SPARK-45590][BUILD][3.5] Upgrade okio to 1.17.6 from 1.15.0 apache/spark#47769

Closed

roczei mentioned this pull request Aug 15, 2024

[SPARK-45590][BUILD][3.4] Upgrade okio to 1.17.6 from 1.15.0 apache/spark#47770

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update `okio` to version 1.17.6 #5587

Update `okio` to version 1.17.6 #5587

Uh oh!

bjornjorgensen commented Nov 14, 2023 •

edited

Loading

Uh oh!

sunix commented Nov 24, 2023

Uh oh!

sonarqubecloud bot commented Nov 24, 2023

Uh oh!

bjornjorgensen commented Dec 12, 2023

Uh oh!

oscerd commented Dec 12, 2023

Uh oh!

manusa commented Dec 12, 2023

Uh oh!

bjornjorgensen commented Apr 22, 2024

Uh oh!

rohanKanojia commented Apr 22, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Update okio to version 1.17.6 #5587

Update okio to version 1.17.6 #5587

Uh oh!

Conversation

bjornjorgensen commented Nov 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist

Uh oh!

sunix commented Nov 24, 2023

Uh oh!

sonarqubecloud bot commented Nov 24, 2023

Uh oh!

bjornjorgensen commented Dec 12, 2023

Uh oh!

oscerd commented Dec 12, 2023

Uh oh!

manusa commented Dec 12, 2023

Uh oh!

bjornjorgensen commented Apr 22, 2024

Uh oh!

rohanKanojia commented Apr 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Update `okio` to version 1.17.6 #5587

Update `okio` to version 1.17.6 #5587

bjornjorgensen commented Nov 14, 2023 •

edited

Loading

rohanKanojia commented Apr 22, 2024 •

edited

Loading