github-actions[bot] commented on code in PR #65700:
URL: https://github.com/apache/doris/pull/65700#discussion_r3621265671
##########
fe/pom.xml:
##########
@@ -264,13 +264,13 @@ under the License.
<cglib.version>2.2</cglib.version>
<commons-cli.version>1.4</commons-cli.version>
<commons-filerupload.version>1.6.0</commons-filerupload.version>
- <commons-configuration2.version>2.11.0</commons-configuration2.version>
+ <commons-configuration2.version>2.15.1</commons-configuration2.version>
Review Comment:
[P2] Account for the new remote-include policy
Commons Configuration 2.15 changed the default location allow-list to
`file,jar`. Hadoop 3.4.2 loads `hadoop-metrics2*.properties` through
`PropertiesConfiguration`, so an existing `include = https://...` now raises
`ConfigurationException` / `MetricsConfigException` and the metrics system does
not start (normal initialization logs the failure). Since 2.11 accepted this
configuration and the PR marks behavior unchanged, please either preserve
trusted remote includes with a narrowly scoped allow-list, or explicitly
document the break and add coverage for the intended policy.
##########
fe/pom.xml:
##########
@@ -403,6 +404,9 @@ under the License.
<asm.version>9.4</asm.version>
<airlift.concurrent.version>202</airlift.concurrent.version>
<azure.sdk.version>1.3.7</azure.sdk.version>
+ <azure.core.version>1.58.1</azure.core.version>
Review Comment:
[P2] Remove the Azure overrides that do not fix these CVEs
CVE-2026-33117 is in `azure-security-keyvault-keys` before 4.10.6; BOM 1.3.7
already manages 4.10.7, and no FE module declares that artifact. The cited
identity advisories are also already fixed by the base graph's Identity 1.18.3
/ MSAL4J 1.25.0. These dependency-only patch releases therefore remove no
affected runtime coordinate, while their 1.x versions still satisfy the generic
`< 4.10.6` CPE range if that fuzzy match persists. Please drop these BOM
overrides, or identify the actual shipped vulnerable coordinate and fixed range
they remediate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
