HCD-62 Upgrade of several libraries #1563
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Checklist before you submit for review
|
bereng
changed the title
bereng
force-pushed
the
HCD-62-HCD-1.1
branch
from
7beea20 to
ab80656
Compare
bereng
changed the title
|
Note to self: The commit message will have to be amended before merge to reflect Guava stays at v29 |
bereng
commented
Feb 19, 2025
test/distributed/org/apache/cassandra/distributed/test/FailingRepairTest.java
Outdated
Show resolved
Hide resolved
jakubzytka
reviewed
Feb 24, 2025
|
Please update the commit messages and pr description to list all the CVEs being fixed here. |
bereng
force-pushed
the
HCD-62-HCD-1.1
branch
2 times, most recently
from
f56bcca to
229cab9
Compare
|
@bereng could you rebase the PR to trigger the CI on the updated branch? |
src/java/org/apache/cassandra/config/YamlConfigurationLoader.java
Outdated
Show resolved
Hide resolved
szymon-miezal
approved these changes
Mar 21, 2025
This commit contains the following upgrades * snappy to 1.1.10.7 fixing CVE-2023-43642 * guava to 33.4.0-jre fixing CVE-2023-2976 and CVE-2020-8908 * jackson to 2.18.0 fixing CWE-400 * snakeyaml to 2.4 fixing CVE-2022-1471
|
❌ Build ds-cassandra-pr-gate/PR-1563 rejected by Butler1 new test failure(s) in 10 builds Found 1 new test failures
Found 18 known test failures |
jkni
added a commit
that referenced
this pull request
Apr 8, 2025
…ate cdc_enabled key in base yaml (#1680) ### What is the issue #1563 upgraded our version of snakeyaml. This new version logs when duplicate keys are found. The test-cdc target concatenates a CDC-specific yaml to the base yaml. Both contain entries for the cdc_enabled key, causing tests that load this yaml to log the warning. This causes CDC CI failures. ### What does this PR fix and why was it fixed This PR removes the cdc_enabled entry in the base yaml, as it's the same as the default. This is consistent with how we handle other default keys that might be duplicated across multiple yaml fragments in the test commands.
djatnieks
pushed a commit
that referenced
this pull request
Apr 14, 2025
The customer requested an upgrade for some libraries (CVEs) This PR upgrades to latest stable versions - snappy to 1.1.10.7 fixing CVE-2023-43642 - guava to 33.4.0-jre fixing CVE-2023-2976 and CVE-2020-8908 - jackson to 2.18.0 fixing CWE-400 - snakeyaml to 2.4 fixing CVE-2022-1471
djatnieks
pushed a commit
that referenced
this pull request
Apr 14, 2025
…ate cdc_enabled key in base yaml (#1680) ### What is the issue #1563 upgraded our version of snakeyaml. This new version logs when duplicate keys are found. The test-cdc target concatenates a CDC-specific yaml to the base yaml. Both contain entries for the cdc_enabled key, causing tests that load this yaml to log the warning. This causes CDC CI failures. ### What does this PR fix and why was it fixed This PR removes the cdc_enabled entry in the base yaml, as it's the same as the default. This is consistent with how we handle other default keys that might be duplicated across multiple yaml fragments in the test commands.
djatnieks
pushed a commit
that referenced
this pull request
May 18, 2025
The customer requested an upgrade for some libraries (CVEs) This PR upgrades to latest stable versions - snappy to 1.1.10.7 fixing CVE-2023-43642 - guava to 33.4.0-jre fixing CVE-2023-2976 and CVE-2020-8908 - jackson to 2.18.0 fixing CWE-400 - snakeyaml to 2.4 fixing CVE-2022-1471
djatnieks
pushed a commit
that referenced
this pull request
May 18, 2025
…ate cdc_enabled key in base yaml (#1680) ### What is the issue #1563 upgraded our version of snakeyaml. This new version logs when duplicate keys are found. The test-cdc target concatenates a CDC-specific yaml to the base yaml. Both contain entries for the cdc_enabled key, causing tests that load this yaml to log the warning. This causes CDC CI failures. ### What does this PR fix and why was it fixed This PR removes the cdc_enabled entry in the base yaml, as it's the same as the default. This is consistent with how we handle other default keys that might be duplicated across multiple yaml fragments in the test commands.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is the issue
The customer requested an upgrade for some libraries (CVEs)
What does this PR fix and why was it fixed
This PR upgrades to latest stable versions