[
https://issues.apache.org/jira/browse/HADOOP-18687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17707239#comment-17707239
]
ASF GitHub Bot commented on HADOOP-18687:
-----------------------------------------
mjwiq commented on PR #5524:
URL: https://github.com/apache/hadoop/pull/5524#issuecomment-1491799598
I did not remove the entry from pom.xml in hadoop-project because it also
sets the version for json-smart that is included in hdfs:
```[INFO] org.apache.hadoop:hadoop-hdfs-client:jar:3.4.0-SNAPSHOT
[INFO] \- org.mock-server:mockserver-netty:jar:5.11.1:test
[INFO] \- org.mock-server:mockserver-core:jar:5.11.1:test
[INFO] \- com.jayway.jsonpath:json-path:jar:2.4.0:test
[INFO] \- net.minidev:json-smart:jar:2.4.7:test
[INFO] \- net.minidev:accessors-smart:jar:2.4.7:test
```
> Remove unnecessary dependency on json-smart
> -------------------------------------------
>
> Key: HADOOP-18687
> URL: https://issues.apache.org/jira/browse/HADOOP-18687
> Project: Hadoop Common
> Issue Type: Improvement
> Components: auth
> Affects Versions: 3.4.0, 3.3.5
> Reporter: Michiel de Jong
> Priority: Major
> Labels: pull-request-available
>
> hadoop-auth has a dependency on net.minidev:json-smart 2.4.7, but this
> dependency is never used.
> This dependency was originally included because the transitive dependency
> that nimbus-jose-jwt had did not work properly (see
> https://issues.apache.org/jira/browse/HADOOP-14903). Since version 9.*
> nimbus-jose-jwt is using its own shaded version of json-smart, so the version
> declared in hadoop-auth is never actually used.
> json-smart 2.4.7 shows up in CVE scans for CVE-2023-1370. It is still used as
> a transitive dependency in hadoop-hdfs
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
