CalvinKirs opened a new pull request, #67585:
URL: https://github.com/apache/doris/pull/67585
### What problem does this PR solve?
Related PR: #67065
Problem Summary:
The FE dependency graph selects gRPC 1.65.1, including `grpc-netty-shaded`
affected by CVE-2025-55163. Upgrade the managed gRPC BOM to 1.75.0, matching
#67065.
Both MaxCompute connectors now exclude `org.lz4:lz4-pure-java` directly from
each `odps-sdk-core` and `odps-sdk-table-api` declaration and explicitly depend
on the parent-managed `at.yawk.lz4:lz4-java:1.11.1`. This replaces the legacy
artifact without relying on dependency-management exclusion merging. ODPS
dependencies now belong to `fe-connector-maxcompute` rather than `fe-common` or
`fe-core`, so the FE change is applied at that declaration site. Current
MaxCompute reads and writes continue to select ZSTD; the LZ4 replacement
preserves the SDK dependency closure.
Limit `flight-sql-jdbc-driver` to test scope. The FE test client loads this
JDBC driver, while production code uses `FlightServer` and `FlightSqlClient`
from the retained Flight protocol libraries. The regression framework keeps its
independent JDBC driver dependency.
### Release note
Upgrade gRPC to 1.75.0 and replace the legacy ODPS LZ4 dependency with
`lz4-java` 1.11.1. Remove the test-only Flight SQL JDBC driver from the FE
runtime distribution.
### Check List (For Author)
- Test
- [ ] Regression test
- [ ] Unit Test
- [x] Manual test (add detailed scripts or steps below)
Validation on commit `1dc2da6441292bbffbc1cadc3ed3872a6f617be4`:
- `FE_MAVEN_THREADS=4 MVN_OPT=-Dmaven.build.cache.enabled=false ./build.sh
--fe` completed successfully. All 73 Maven modules passed, including
Checkstyle, FE main/test source compilation, and packaging. Maven wall time: 5m
28s. Test execution was skipped by the build script.
- Maven `dependency:tree` for `fe-core`, `fe-connector-maxcompute`, and
`max-compute-connector` with reactor dependencies confirmed gRPC 1.75.0, LZ4
1.11.1, no `lz4-pure-java` in the connector trees, and JDBC driver test scope.
- Checked the actual `output/fe` distribution:
`grpc-netty-shaded-1.75.0.jar` is present; the MaxCompute plugin includes
`lz4-java-1.11.1.jar`; no `lz4-pure-java` or `flight-sql-jdbc-driver` jar is
present.
- XML checks verified direct exclusions on all four actual ODPS SDK
declarations. `git diff --check` passed.
- Unit tests, cluster startup, and regression tests were not run.
- Behavior changed:
- [ ] No.
- [x] Yes. Dependency versions and FE runtime packaging change;
MaxCompute compression selection is unchanged.
- Does this need documentation?
- [x] No.
- [ ] Yes.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
