FrankChen021 commented on code in PR #20790:
URL: https://github.com/apache/druid/pull/20790#discussion_r4429470177
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -163,7 +165,7 @@
<cve>CVE-2025-5115</cve> <!-- netty issue in shaded hadoop -->
</suppress>
- <suppress>
+ <suppress until="2027-04-30Z">
Review Comment:
[P2] Undated Hadoop stopgap suppressions remain
**Finding:** The new until attribute is added only to the
hadoop-client-runtime 3.5.0 rule. The existing hadoop-client-runtime 3.3.6
block immediately above still contains pending-upgrade suppressions whose
comments mention an upcoming Hadoop fix, no fix yet, or upgrading to Hadoop
3.4, but it has no expiry. Those rules continue to hide future scanner findings
indefinitely, so the PR's re-assessment guarantee does not cover all temporary
Hadoop suppressions.
**Suggestion:** Split mixed permanent and temporary entries where needed and
add an explicit expiry to each still-pending suppression, with a lightweight CI
check if this policy should remain enforced.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
