From 53a40b71c2f883fe76f5db8d113cdd14039a6947 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 26 Sep 2024 01:57:55 +0000 Subject: [PATCH 1/8] fix: pom.xml to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHADOOP-8089372 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 4ecf1e26a..7b0f9f1ed 100644 --- a/pom.xml +++ b/pom.xml @@ -50,7 +50,7 @@ 1.11.0 2.17.2 32.0.1-jre - 3.3.6 + 3.4.0 1.5.2 true 0.8.5 From c7f4a5fa071b8ca15876a7ba3c1c190b013dc615 Mon Sep 17 00:00:00 2001 From: Xin Huang Date: Mon, 30 Sep 2024 13:09:24 -0500 Subject: [PATCH 2/8] test --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 7b0f9f1ed..b97561380 100644 --- a/pom.xml +++ b/pom.xml @@ -517,14 +517,14 @@ org.apache.commons commons-configuration2 - + org.apache.iceberg iceberg-api From baff2abbcdc97be1cfb7c15816a4a098f343efa1 Mon Sep 17 00:00:00 2001 From: Xin Huang Date: Mon, 30 Sep 2024 13:11:32 -0500 Subject: [PATCH 3/8] test remove --- pom.xml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/pom.xml b/pom.xml index b97561380..642533c67 100644 --- a/pom.xml +++ b/pom.xml @@ -517,14 +517,6 @@ org.apache.commons commons-configuration2 - org.apache.iceberg iceberg-api From 5b80238481cd5e8f5f65b6a379389f06ba75f88b Mon Sep 17 00:00:00 2001 From: Xin Huang Date: Mon, 30 Sep 2024 13:18:46 -0500 Subject: [PATCH 4/8] revert --- pom.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pom.xml b/pom.xml index 642533c67..994627cc9 100644 --- a/pom.xml +++ b/pom.xml @@ -517,6 +517,14 @@ org.apache.commons commons-configuration2 + + org.apache.hadoop + hadoop-common + + + org.apache.hadoop + hadoop-mapreduce-client-core + org.apache.iceberg iceberg-api From 42d2a5776fe43c1f8025f73538d0bbcf9e08eb65 Mon Sep 17 00:00:00 2001 From: Xin Huang Date: Mon, 30 Sep 2024 13:20:18 -0500 Subject: [PATCH 5/8] fix whitespace --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 994627cc9..7b0f9f1ed 100644 --- a/pom.xml +++ b/pom.xml @@ -524,7 +524,7 @@ org.apache.hadoop hadoop-mapreduce-client-core - + org.apache.iceberg iceberg-api From 7248dcfd718f880da64ce4e8c37e56233bee11d8 Mon Sep 17 00:00:00 2001 From: Xin Huang Date: Mon, 30 Sep 2024 14:28:05 -0500 Subject: [PATCH 6/8] upgrade netty too for the hadoop upgrade --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 7b0f9f1ed..e8e917c98 100644 --- a/pom.xml +++ b/pom.xml @@ -61,7 +61,7 @@ 1.8 1.8 2.4.9 - 4.1.94.Final + 4.1.113.Final 9.37.3 3.1 1.14.1 From 7a7a4de0db1e7f725be654a4268a1f105ce11086 Mon Sep 17 00:00:00 2001 From: Jay Patel Date: Wed, 2 Oct 2024 13:19:18 -0700 Subject: [PATCH 7/8] Fix maven package --- pom.xml | 13 +++++++++++++ scripts/process_licenses.py | 4 ++++ 2 files changed, 17 insertions(+) diff --git a/pom.xml b/pom.xml index e8e917c98..baeec5966 100644 --- a/pom.xml +++ b/pom.xml @@ -240,6 +240,10 @@ org.apache.zookeeper zookeeper + + org.bouncycastle + bcprov-jdk15on + org.eclipse.jetty jetty-server @@ -385,6 +389,14 @@ javax.xml.bind jaxb-api + + org.apache.hadoop + hadoop-yarn-common + + + org.bouncycastle + bcprov-jdk15on + org.slf4j slf4j-reload4j @@ -1265,6 +1277,7 @@ generate-resources + true python3 ${project.basedir}/scripts/process_licenses.py diff --git a/scripts/process_licenses.py b/scripts/process_licenses.py index 9f715abd6..accf84398 100644 --- a/scripts/process_licenses.py +++ b/scripts/process_licenses.py @@ -50,6 +50,10 @@ "com.nimbusds:nimbus-jose-jwt": APACHE_LICENSE, "com.github.stephenc.jcip:jcip-annotations": APACHE_LICENSE, "io.netty:netty-common": APACHE_LICENSE, + "io.netty:netty-handler": APACHE_LICENSE, + "io.netty:netty-resolver": APACHE_LICENSE, + "io.netty:netty-buffer": APACHE_LICENSE, + "io.netty:netty-transport": APACHE_LICENSE, "com.google.re2j:re2j": GO_LICENSE, "com.google.protobuf:protobuf-java": BSD_3_CLAUSE_LICENSE, "com.google.code.gson:gson": APACHE_LICENSE, From 8ab3e42735fa2109188135c518dcebe28e7650f8 Mon Sep 17 00:00:00 2001 From: Jay Patel Date: Wed, 2 Oct 2024 13:57:20 -0700 Subject: [PATCH 8/8] Fix maven install - works locally --- pom.xml | 1 - scripts/check_content.sh | 1 + scripts/process_licenses.py | 4 ++++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index baeec5966..f1c746a56 100644 --- a/pom.xml +++ b/pom.xml @@ -1277,7 +1277,6 @@ generate-resources - true python3 ${project.basedir}/scripts/process_licenses.py diff --git a/scripts/check_content.sh b/scripts/check_content.sh index e4d3e2076..7608c23ec 100755 --- a/scripts/check_content.sh +++ b/scripts/check_content.sh @@ -28,6 +28,7 @@ if jar tvf $DIR/../target/snowflake-ingest-sdk.jar | awk '{print $8}' | \ grep -v PropertyList-1.0.dtd | \ grep -v properties.dtd | \ grep -v parquet.thrift | \ + grep -v assets/org/apache/commons/math3/random/new-joe-kuo-6.1000 | \ # Native zstd libraries are allowed grep -v -E '^darwin' | \ diff --git a/scripts/process_licenses.py b/scripts/process_licenses.py index accf84398..b5181bce1 100644 --- a/scripts/process_licenses.py +++ b/scripts/process_licenses.py @@ -54,6 +54,10 @@ "io.netty:netty-resolver": APACHE_LICENSE, "io.netty:netty-buffer": APACHE_LICENSE, "io.netty:netty-transport": APACHE_LICENSE, + "io.netty:netty-transport-native-unix-common": APACHE_LICENSE, + "io.netty:netty-codec": APACHE_LICENSE, + "io.netty:netty-transport-native-epoll": APACHE_LICENSE, + "io.netty:netty-transport-classes-epoll": APACHE_LICENSE, "com.google.re2j:re2j": GO_LICENSE, "com.google.protobuf:protobuf-java": BSD_3_CLAUSE_LICENSE, "com.google.code.gson:gson": APACHE_LICENSE,