Skip to content

[FLINK-33627] Bump snappy to 1.1.10.5 #341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[FLINK-33627] Bump snappy to 1.1.10.5 #341

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2af0c91
[FLINK-33149][build] Bump snappy to 1.1.10.4
Sep 26, 2023
cac33ba
[FLINK-33627][build] Bump snappy to 1.1.10.5
Nov 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,6 @@ under the License.
<unixsocket.version>2.3.2</unixsocket.version>
<protoc-jar-maven-plugin.version>3.11.1</protoc-jar-maven-plugin.version>
<flink.version>1.16.2</flink.version>
<scala.binary.version>2.12</scala.binary.version>
<scala.version>2.12.7</scala.version>
<lz4-java.version>1.8.0</lz4-java.version>
<flink-shaded-jackson.version>2.12.4-15.0</flink-shaded-jackson.version>
Expand Down
4 changes: 2 additions & 2 deletions statefun-flink/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ under the License.
<exclusions>
<!--
This conflicts with org.xerial.snappy:snappy-java
brought from flink-streaming-java_${scala.binary.version} (transitively)
brought from flink-streaming-java (transitively)
-->
<exclusion>
<groupId>org.xerial.snappy</groupId>
Expand Down Expand Up @@ -173,7 +173,7 @@ under the License.
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
<version>1.1.10.1</version>
<version>1.1.10.4</version>
</dependency>
<!--
Pin the scala library version in order to resolve the dependency conversion problem between two
Expand Down
4 changes: 1 addition & 3 deletions statefun-kafka-io/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,7 @@ under the License.
<version>${kafka.version}</version>
<exclusions>
<!-- This collides with snappy-java brought from
org.apache.flink:flink-streaming-java_${scala.binary.version}
org.xerial.snappy:snappy-java:1.1.4
-->
org.apache.flink:flink-streaming-java -->
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be good to leave a comment here. As far as I can see Flink 1.16.2 has snappy-java 1.1.8.3 which is vulnerable - so you want to exclude it here. But 1.17 Flink and above uses snappy-java 1.1.10.4. So this is a point in time change, because of your dependancy on the back level Flink. I assume we would want to move to a provided dependancy when we depend on a Flink 1.17 or above. Have I understood this correctly?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello! If I understand correctly, the version of snappy brought in from flink-streaming-java must be compatible with the kafka client, or there's little hope of it working -- in my experience, this has always been the case with snappy patch releases, so 1.1.8.x should be OK with 1.1.10.x.

Users on Flink 1.16.2 will certainly have the vulnerability in flink-statefun (but also in all of the flink core APIs). We're currently voting on a 1.16.3 release with the bump.

I'm open to a comment suggestion, but I'm not sure what would be useful or remain timely! Wrangling dependencies is not an easy problem, so when I see an exclusion like this, I just assume the original author wanted a single authoritive source for the version.

<exclusion>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
Expand Down