This is an automated email from the ASF dual-hosted git repository.
pvillard31 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new 102f7afe3aa NIFI-16244 Set HttpClient 5 to 5.6.4 and ignore Jackson
for Hazelcast 5 (#11584)
102f7afe3aa is described below
commit 102f7afe3aa10fe765fe08cb9e2faef924d09b0b
Author: David Handermann <[email protected]>
AuthorDate: Mon Aug 24 03:22:59 2026 -0500
NIFI-16244 Set HttpClient 5 to 5.6.4 and ignore Jackson for Hazelcast 5
(#11584)
---
.github/workflows/code-compliance.yml | 1 +
.grype.yaml | 127 +++++++++++++++++++++
nifi-extension-bundles/nifi-aws-bundle/pom.xml | 6 -
nifi-extension-bundles/nifi-iceberg-bundle/pom.xml | 6 -
pom.xml | 11 ++
5 files changed, 139 insertions(+), 12 deletions(-)
diff --git a/.github/workflows/code-compliance.yml
b/.github/workflows/code-compliance.yml
index 5ef588a9c1b..9287c453570 100644
--- a/.github/workflows/code-compliance.yml
+++ b/.github/workflows/code-compliance.yml
@@ -124,4 +124,5 @@ jobs:
sbom: nifi-${{ env.PROJECT_VERSION }}.spdx.json
severity-cutoff: 'medium'
only-fixed: true
+ output-format: table
fail-build: ${{ github.ref_name == 'main' && 'true' || 'false' }}
diff --git a/.grype.yaml b/.grype.yaml
index c11729f14aa..d0277c04064 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -13,3 +13,130 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+ignore:
+ - vulnerability: GHSA-r7wm-3cxj-wff9
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-core
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-j3rv-43j4-c7qm
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-rmj7-2vxq-3g9f
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-hgj6-7826-r7m5
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-5gvw-p9qm-jgwh
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-5hh8-q8hv-fr38
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-rcqc-6cw3-h962
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-mhm7-754m-9p8w
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-5jmj-h7xm-6q6v
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-9fxm-vc8v-hj55
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-3pjw-73gf-8qr5
+ reason: Jackson 2 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 2.21.2
+ type: java-archive
+ - vulnerability: GHSA-r7wm-3cxj-wff9
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-core
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-j3rv-43j4-c7qm
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-rmj7-2vxq-3g9f
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-hgj6-7826-r7m5
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-5gvw-p9qm-jgwh
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-5hh8-q8hv-fr38
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-rcqc-6cw3-h962
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-5jmj-h7xm-6q6v
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-9fxm-vc8v-hj55
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
+ - vulnerability: GHSA-3pjw-73gf-8qr5
+ reason: Jackson 3 shaded by hazelcast 5.7.0
+ package:
+ name: jackson-databind
+ version: 3.1.2
+ type: java-archive
diff --git a/nifi-extension-bundles/nifi-aws-bundle/pom.xml
b/nifi-extension-bundles/nifi-aws-bundle/pom.xml
index 32bdc470262..3154778bbd1 100644
--- a/nifi-extension-bundles/nifi-aws-bundle/pom.xml
+++ b/nifi-extension-bundles/nifi-aws-bundle/pom.xml
@@ -53,12 +53,6 @@
<version>2.12.0-SNAPSHOT</version>
<scope>provided</scope>
</dependency>
- <!-- Override httpclient 5.6 from apache5-client -->
- <dependency>
- <groupId>org.apache.httpcomponents.client5</groupId>
- <artifactId>httpclient5</artifactId>
- <version>5.6.4</version>
- </dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>sts</artifactId>
diff --git a/nifi-extension-bundles/nifi-iceberg-bundle/pom.xml
b/nifi-extension-bundles/nifi-iceberg-bundle/pom.xml
index dbfff573586..1f3d5948c22 100644
--- a/nifi-extension-bundles/nifi-iceberg-bundle/pom.xml
+++ b/nifi-extension-bundles/nifi-iceberg-bundle/pom.xml
@@ -69,12 +69,6 @@
<artifactId>aircompressor</artifactId>
<version>2.0.3</version>
</dependency>
- <!-- Override httpclient 5.6 from iceberg-core -->
- <dependency>
- <groupId>org.apache.httpcomponents.client5</groupId>
- <artifactId>httpclient5</artifactId>
- <version>5.6.4</version>
- </dependency>
</dependencies>
</dependencyManagement>
</project>
diff --git a/pom.xml b/pom.xml
index 3fd1a5b7c19..2d65fb8be0f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -180,6 +180,7 @@
<okhttp.version>5.5.0</okhttp.version>
<okio.version>3.18.1</okio.version>
<org.apache.httpcomponents.httpclient.version>4.5.14</org.apache.httpcomponents.httpclient.version>
+
<org.apache.httpcomponents.httpclient5.version>5.6.4</org.apache.httpcomponents.httpclient5.version>
<org.apache.httpcomponents.httpcore.version>4.4.16</org.apache.httpcomponents.httpcore.version>
<org.apache.httpcomponents.httpcore5.version>5.4.3</org.apache.httpcomponents.httpcore5.version>
<org.apache.sshd.version>2.19.0</org.apache.sshd.version>
@@ -370,6 +371,16 @@
<artifactId>httpcore5-h2</artifactId>
<version>${org.apache.httpcomponents.httpcore5.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.httpcomponents.client5</groupId>
+ <artifactId>httpclient5</artifactId>
+
<version>${org.apache.httpcomponents.httpclient5.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.httpcomponents.client5</groupId>
+ <artifactId>httpclient5-cache</artifactId>
+
<version>${org.apache.httpcomponents.httpclient5.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>fluent-hc</artifactId>
