CalvinKirs opened a new pull request, #67000: URL: https://github.com/apache/doris/pull/67000
### What problem does this PR solve? Issue Number: None FE dependency-check reports CVE-2023-33202 for bcprov-jdk15on 1.70, which is pulled transitively by Huawei IAM in the OBS filesystem plugin. The jdk15on artifact line ends at the vulnerable 1.70 release, so this change excludes it and provides the compatible maintained bcprov-jdk18on 1.78.1 artifact instead. Thrift findings are intentionally out of scope. ### How to test - Maven dependency tree: BUILD SUCCESS; bcprov-jdk15on is absent and OBS resolves bcprov-jdk18on 1.78.1. - OWASP dependency-check aggregate: BUILD SUCCESS; zero bcprov-jdk15on dependencies and zero CVE-2023-33202 findings. - OBS plugin package: contains bcprov-jdk18on-1.78.1.jar and no bcprov-jdk15on artifact. - FE clean install with tests skipped: 73 of 74 modules completed successfully, including OBS and Checkstyle. The final fe-core code-generation phase was terminated by the local environment with exit code 137. ### Release note None ### Check List (For Author) - Test: dependency tree, dependency-check aggregate, FE compilation with tests skipped - Behavior changed: No - Does this need documentation: No -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
