This is an automated email from the ASF dual-hosted git repository.
jerryshao pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 9105c0c9bd [#11183] improvement(deps): Upgrade SnakeYAML from 1.33 to
2.0 (#11184)
9105c0c9bd is described below
commit 9105c0c9bd2b6016847b607a5e43775378beee4a
Author: geyanggang <[email protected]>
AuthorDate: Mon May 25 14:25:06 2026 +0800
[#11183] improvement(deps): Upgrade SnakeYAML from 1.33 to 2.0 (#11184)
### What changes were proposed in this pull request?
Upgrade the transitive dependency `org.yaml:snakeyaml` from 1.33 to 2.0
by adding a version catalog entry and a global dependency constraint.
### Why are the changes needed?
SnakeYAML 1.33 is outdated. Version 2.0 provides improved security
defaults and stability.
Fix: #11183
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
- Verified dependency resolution via `./gradlew :lineage:dependencies`
- Ran `./gradlew :lineage:test` — all tests pass
- Ran `./gradlew :server:test` — all tests pass
- Confirmed no direct SnakeYAML API usage in Gravitino source code
---------
Co-authored-by: Jerry Shao <[email protected]>
---
gradle/libs.versions.toml | 2 ++
lineage/build.gradle.kts | 4 ++++
2 files changed, 6 insertions(+)
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index ae67ef69ef..b448f879fa 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -24,6 +24,7 @@ reactor-netty-http = "1.2.1"
reactor-netty-core = "1.2.1"
junit = "5.8.1"
jackson = "2.15.2"
+snakeyaml = "2.0"
guava = "32.1.3-jre"
lombok = "1.18.20"
slf4j = "2.0.16"
@@ -173,6 +174,7 @@ jackson-annotations = { group =
"com.fasterxml.jackson.core", name = "jackson-an
jackson-datatype-jdk8 = { group = "com.fasterxml.jackson.datatype", name =
"jackson-datatype-jdk8", version.ref = "jackson" }
jackson-datatype-jsr310 = { group = "com.fasterxml.jackson.datatype", name =
"jackson-datatype-jsr310", version.ref = "jackson" }
jackson-dataformat-yaml = { group = "com.fasterxml.jackson.dataformat", name =
"jackson-dataformat-yaml", version.ref = "jackson" }
+snakeyaml = { group = "org.yaml", name = "snakeyaml", version.ref =
"snakeyaml" }
jackson-jaxrs-json-provider = { group = "com.fasterxml.jackson.jaxrs", name =
"jackson-jaxrs-json-provider", version.ref = "jackson" }
guava = { group = "com.google.guava", name = "guava", version.ref = "guava" }
kerby-core = { group = "org.apache.kerby", name = "kerb-core", version.ref =
"kerby"}
diff --git a/lineage/build.gradle.kts b/lineage/build.gradle.kts
index a85ee88ecc..81f3442064 100644
--- a/lineage/build.gradle.kts
+++ b/lineage/build.gradle.kts
@@ -38,6 +38,10 @@ dependencies {
implementation(libs.jackson.dataformat.yaml)
implementation(libs.micrometer.core)
+ constraints {
+ implementation(libs.snakeyaml)
+ }
+
annotationProcessor(libs.lombok)
compileOnly(libs.lombok)
testAnnotationProcessor(libs.lombok)
