[Backport 2.8] Resolve CVE-2023-2976 by forcing use of Guava 32.0.1 (#2937) #2975
Conversation
Signed-off-by: Stephen Crawford <[email protected]> (cherry picked from commit 8ab7cb4) Signed-off-by: Darshit Chanpura <[email protected]>
DarshitChanpura
requested review from
cliu123,
cwperks,
davidlago,
peternied,
RyanL1997 and
stephen-crawford
as code owners
Signed-off-by: Darshit Chanpura <[email protected]>
Codecov Report
@@ Coverage Diff @@
## 2.8 #2975 +/- ##
============================================
- Coverage 61.53% 61.46% -0.07%
+ Complexity 3386 3380 -6
============================================
Files 264 264
Lines 18665 18665
Branches 3288 3288
============================================
- Hits 11485 11472 -13
- Misses 5597 5605 +8
- Partials 1583 1588 +5 |
DarshitChanpura
dismissed stale reviews from willyborankin and stephen-crawford
via
3c436a3
build.gradle
Outdated
| @@ -285,17 +285,20 @@ configurations.all { | |||
| force "io.netty:netty-transport:${versions.netty}" | |||
| force "io.netty:netty-transport-native-unix-common:${versions.netty}" | |||
| force "org.apache.bcel:bcel:6.6.0" // This line should be removed once Spotbugs is upgraded to 4.7.4 | |||
| force "com.github.luben:zstd-jni:${versions.zstd}" | |||
There was a problem hiding this comment.
Could not resolve com.github.luben:zstd-jni:null.
There was a problem hiding this comment.
Hmmm I think for 2.x it needs to be 1.5.5-3. Since versions.zstd comes with 2.9 version. So after 2.9 has been released we can use it in 2.x or I'm missing something
There was a problem hiding this comment.
Ah, sorry for the misleading comment. I did not notice that it is for 2.8 version. The version of ZSTD should stay the same in this case.
ZSTD 1.5.5-3 was merged in OS main branch and I hope will be released in 2.9 and before that sec plugin uses its own. To avoid regressions lets leave it as is.
Signed-off-by: Darshit Chanpura <[email protected]>
|
No longer needed as 2.9 is about to be released. |
Backports #2937
Check List
- [ ] New functionality includes testing- [ ] New functionality has been documentedBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.