[
https://issues.apache.org/jira/browse/HADOOP-18687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17714192#comment-17714192
]
ASF GitHub Bot commented on HADOOP-18687:
-----------------------------------------
ayushtkn commented on PR #5549:
URL: https://github.com/apache/hadoop/pull/5549#issuecomment-1514994312
@pjfanning no worries, I am sure about them, they aren't related. They are
failing in the daily build as well. Need to chase them, not getting time
unfortunately
The daily build test result. I think all are same as in this PR
https://ci-hadoop.apache.org/view/Hadoop/job/hadoop-qbt-trunk-java8-linux-x86_64/1199/testReport/
> Remove unnecessary dependency on json-smart
> -------------------------------------------
>
> Key: HADOOP-18687
> URL: https://issues.apache.org/jira/browse/HADOOP-18687
> Project: Hadoop Common
> Issue Type: Improvement
> Components: auth
> Affects Versions: 3.4.0, 3.3.5
> Reporter: Michiel de Jong
> Assignee: Michiel de Jong
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.4.0
>
>
> hadoop-auth has a dependency on net.minidev:json-smart 2.4.7, but this
> dependency is never used.
> This dependency was originally included because the transitive dependency
> that nimbus-jose-jwt had did not work properly (see
> https://issues.apache.org/jira/browse/HADOOP-14903). Since version 9.*
> nimbus-jose-jwt is using its own shaded version of json-smart, so the version
> declared in hadoop-auth is never actually used.
> json-smart 2.4.7 shows up in CVE scans for CVE-2023-1370. It is still used as
> a transitive dependency in hadoop-hdfs
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
