CalvinKirs opened a new pull request, #65700:
URL: https://github.com/apache/doris/pull/65700
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
This PR upgrades FE dependencies that are directly controlled by the Maven
POMs and were reported by dependency-check on the updated `rich/master`
baseline.
Updated dependencies:
- `commons-configuration2` from `2.11.0` to `2.15.1`
- `postgresql` from `42.7.3` to `42.7.13`
- `dev.cel` from `0.12.0` to `0.13.1`
- Azure SDK components above the latest imported BOM stable patch levels:
- `azure-core` to `1.58.1`
- `azure-core-http-netty` to `1.16.5`
- `azure-identity` to `1.18.4`
The refreshed dependency-check JSON no longer contains the old direct
vulnerable coordinates `[email protected]` or `[email protected]`.
Some remaining findings are still reported for shaded/bundled dependencies or
CPE matches that are not safely removable through a small POM-only change.
### Release note
None
### Check List (For Author)
- Test:
- `env DORIS_THIRDPARTY=/mnt/disk1/gq/idea/thirdparty mvn -pl fe-core
-am install -DskipTests -Dskip.doc=true -Dmaven.build.cache.enabled=false`
- `mvn org.owasp:dependency-check-maven:12.2.0:aggregate -Dformat=ALL
-DfailBuildOnCVSS=11 -DfailOnError=false -DnvdApiServerId=nvd-api-key
-DnvdValidForHours=2160 -Dmaven.build.cache.enabled=false
-DyarnAuditAnalyzerEnabled=false -DretireJsAnalyzerEnabled=false
-DassemblyAnalyzerEnabled=false -DnugetconfAnalyzerEnabled=false
-DnuspecAnalyzerEnabled=false -DskipTests`
- Behavior changed: No
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
