FrankChen021 commented on code in PR #19808:
URL: https://github.com/apache/druid/pull/19808#discussion_r3744207940
##########
extensions-contrib/ambari-metrics-emitter/pom.xml:
##########
@@ -119,16 +119,6 @@
<artifactId>JUnitParams</artifactId>
Review Comment:
Addressed in commit 3b80ce5385. ambari-metrics-common:2.7.0.0.0 is the
latest published release, and its AbstractTimelineMetricsSink uses the
relocated Jackson 1.9.13 classes bundled inside that jar, so upgrading it is
not a compatible drop-in fix. I added an explicit exclusion for
org.codehaus.jackson:jackson-xc, removing the unrelocated Jackson artifact from
the emitter dependency graph, and documented the retained explicit CVE
assessment for the unavoidable shaded runtime copy. The focused dependency tree
now has no org.codehaus.jackson entries, and all 28 Ambari emitter tests pass.
##########
extensions-contrib/ambari-metrics-emitter/pom.xml:
##########
@@ -119,16 +119,6 @@
<artifactId>JUnitParams</artifactId>
Review Comment:
This is addressed in the same commit, 3b80ce5385. The compile-scoped
ambari-metrics-common dependency now explicitly excludes
org.codehaus.jackson:jackson-xc, so dependency-tree validation no longer
resolves any unrelocated org.codehaus.jackson artifact. The Ambari jar
necessarily retains its relocated Jackson 1.9.13 implementation because
AbstractTimelineMetricsSink uses it and 2.7.0.0.0 is the latest published
release; I documented and retained the explicit CVE suppression assessment for
that shaded copy. All 28 Ambari emitter tests pass with the exclusion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
