FrankChen021 commented on code in PR #20852:
URL: https://github.com/apache/druid/pull/20852#discussion_r4480394431
##########
pom.xml:
##########
@@ -97,19 +97,19 @@
<datasketches.memory.version>2.2.0</datasketches.memory.version>
<derby.version>10.17.1.0</derby.version>
<dropwizard.metrics.version>4.2.40</dropwizard.metrics.version>
- <errorprone.annotations.version>2.50.0</errorprone.annotations.version>
+ <errorprone.annotations.version>2.52.0</errorprone.annotations.version>
<errorprone.version>2.50.0</errorprone.version>
<fabric8.version>8.0.0</fabric8.version>
<fastutil.version>8.5.19</fastutil.version>
- <guava.version>33.7.2-jre</guava.version>
+ <guava.version>33.8.0-jre</guava.version>
Review Comment:
[P1] Shaded OpenTelemetry Guava remains on old version
**Finding:** The root Guava version is raised to 33.8.0-jre, but
extensions-contrib/opentelemetry-emitter/pom.xml keeps its separate
shade.guava.version at 33.7.2-jre. The shade configuration packages and
relocates com.google.guava, so the extension still ships the old Guava classes
and the Guava security fix is not applied to that artifact.
**Suggestion:** Update the shaded extension's Guava pin to the fixed release
or make it inherit the root property, then verify the shaded artifact no longer
contains the old Guava version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
