[
https://issues.apache.org/jira/browse/HADOOP-17249?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17192372#comment-17192372
]
Jonathan Turner Eagles commented on HADOOP-17249:
-------------------------------------------------
Usually with libraries such as jackson, API breaking changes are NOT upgraded
within the same hadoop minor version (say 2.10.0 -> 2.10.1). Instead they are
upgraded in new hadoop minor version (say 2.11.0). Without shading, this will
impact customers, and will make it difficult for downstream products to
maintain compatibility.
Many of the vulnerabilities that have been found with jackson and others aren't
a problem in hadoop as its usage can't be exploited. In this case I would
suggest a minor version upgrade that contains the fixes.
As to jackson-databind, this version needs to align with jackson library as
there are compatibility issues as well.
Lastly, when upgrading to an incompatible library please mark the jira as an
incompatible change to make sure it gains the proper attention.
> Upgrade jackson-databind to 2.10 on branch-2.10
> -----------------------------------------------
>
> Key: HADOOP-17249
> URL: https://issues.apache.org/jira/browse/HADOOP-17249
> Project: Hadoop Common
> Issue Type: Improvement
> Affects Versions: 2.10.0
> Reporter: Masatake Iwasaki
> Assignee: Masatake Iwasaki
> Priority: Major
> Labels: pull-request-available
> Time Spent: 20m
> Remaining Estimate: 0h
>
> This is filed to test backporting HADOOP-16905 to branch-2.10.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
