upgrade gson to 2.8.9

[ylwu-amzn]

Signed-off-by: Yaliang Wu [email protected]

Description

Upgrade Gson to 2.8.9

Check List

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[amitgalitz]

LGTM if CI passes, thanks for making this change. Read over https://github.com/google/gson/blob/master/CHANGELOG.md and no breaking change seems to be introduced. Are we backporting this to 1.2 then?

[ylwu-amzn]

LGTM if CI passes, thanks for making this change. Read over https://github.com/google/gson/blob/master/CHANGELOG.md and no breaking change seems to be introduced. Are we backporting this to 1.2 then?

We can backport to all old versions. The vulnerability is from writeReplace method which not used in AD. So should be ok if we don't backfill.
We met some issue before as AD and other components used different versions of Gson. We should test on every version before backporting.

[codecov-commenter]

Codecov Report

Merging #354 (1448c94) into main (c8e8d5a) will decrease coverage by 0.09%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main     #354      +/-   ##
============================================
- Coverage     79.39%   79.30%   -0.10%     
+ Complexity     4103     4095       -8     
============================================
  Files           295      295              
  Lines         17207    17207              
  Branches       1826     1826              
============================================
- Hits          13662    13646      -16     
- Misses         2648     2658      +10     
- Partials        897      903       +6     

Flag	Coverage Δ
plugin	79.30% <ø> (-0.10%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...opensearch/ad/transport/AnomalyResultResponse.java	71.96% <0.00%> (-12.13%)	⬇️
...g/opensearch/ad/model/DetectorValidationIssue.java	64.91% <0.00%> (-3.51%)	⬇️
.../main/java/org/opensearch/ad/cluster/HashRing.java	79.35% <0.00%> (-2.03%)	⬇️
...ain/java/org/opensearch/ad/task/ADTaskManager.java	75.39% <0.00%> (-1.29%)	⬇️
...opensearch/ad/indices/AnomalyDetectionIndices.java	72.09% <0.00%> (-0.19%)	⬇️
...ava/org/opensearch/ad/task/ADHCBatchTaskCache.java	91.35% <0.00%> (+2.46%)	⬆️
...java/org/opensearch/ad/task/ADBatchTaskRunner.java	85.71% <0.00%> (+3.49%)	⬆️