From a1fc31c1cee63919417257bd17c1d0aa76a28bba Mon Sep 17 00:00:00 2001 From: Thomas Farr Date: Sat, 12 Aug 2023 00:16:43 +1200 Subject: [PATCH] Force upgrade the vulnerable dependencies of hadoop-minicluster (#9252) * Force upgrade the vulnerable dependencies of hadoop-minicluster Signed-off-by: Thomas Farr * Add changelog entry Signed-off-by: Thomas Farr --------- Signed-off-by: Thomas Farr --- CHANGELOG.md | 3 +++ test/fixtures/hdfs-fixture/build.gradle | 9 ++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b6bdbafb0fe59..2a8cf50322cc7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -108,6 +108,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Bump `org.apache.maven:maven-model` from 3.9.3 to 3.9.4 ([#9148](https://github.com/opensearch-project/OpenSearch/pull/9148)) - Bump `com.azure:azure-storage-blob` from 12.22.3 to 12.23.0 ([#9231](https://github.com/opensearch-project/OpenSearch/pull/9231)) - Bump `com.diffplug.spotless` from 6.19.0 to 6.20.0 ([#9227](https://github.com/opensearch-project/OpenSearch/pull/9227)) +- Bump `org.xerial.snappy:snappy-java` from 1.1.8.2 to 1.1.10.3 ([#9252](https://github.com/opensearch-project/OpenSearch/pull/9252)) +- Bump `com.squareup.okhttp3:okhttp` from 4.9.3 to 4.11.0 ([#9252](https://github.com/opensearch-project/OpenSearch/pull/9252)) +- Bump `com.squareup.okio:okio` from 2.8.0 to 3.5.0 ([#9252](https://github.com/opensearch-project/OpenSearch/pull/9252)) ### Changed - Perform aggregation postCollection in ContextIndexSearcher after searching leaves ([#8303](https://github.com/opensearch-project/OpenSearch/pull/8303)) diff --git a/test/fixtures/hdfs-fixture/build.gradle b/test/fixtures/hdfs-fixture/build.gradle index ff25e1b0852e1..79841ca70b53a 100644 --- a/test/fixtures/hdfs-fixture/build.gradle +++ b/test/fixtures/hdfs-fixture/build.gradle @@ -45,6 +45,9 @@ dependencies { exclude module: 'protobuf-java' exclude group: 'org.codehaus.jackson' exclude group: "org.bouncycastle" + exclude group: "com.squareup.okhttp3" + exclude group: "org.xerial.snappy" + exclude module: "json-io" } api "org.codehaus.jettison:jettison:${versions.jettison}" api "org.apache.commons:commons-compress:1.23.0" @@ -65,5 +68,9 @@ dependencies { api "org.apache.commons:commons-text:1.10.0" api "commons-net:commons-net:3.9.0" runtimeOnly "com.google.guava:guava:${versions.guava}" - + runtimeOnly("com.squareup.okhttp3:okhttp:4.11.0") { + exclude group: "com.squareup.okio" + } + runtimeOnly "com.squareup.okio:okio:3.5.0" + runtimeOnly "org.xerial.snappy:snappy-java:1.1.10.3" }