[
https://issues.apache.org/jira/browse/HADOOP-18687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17714421#comment-17714421
]
ASF GitHub Bot commented on HADOOP-18687:
-----------------------------------------
ayushtkn commented on PR #5549:
URL: https://github.com/apache/hadoop/pull/5549#issuecomment-1515776728
I have triggered those builds again post reverting this. @pjfanning can you
check once. I think it may be this commit is conflicting with
```0d1b4a3556d24641c14bbfc7ae1b985d4a998649```, the PR ran build on
```0185afafeac26a447b6138b2d74a6f5ed0051d0b``` which is prior to this one. Just
my guess because errors mentioned SBOM
> Remove unnecessary dependency on json-smart
> -------------------------------------------
>
> Key: HADOOP-18687
> URL: https://issues.apache.org/jira/browse/HADOOP-18687
> Project: Hadoop Common
> Issue Type: Improvement
> Components: auth
> Affects Versions: 3.4.0, 3.3.5
> Reporter: Michiel de Jong
> Assignee: Michiel de Jong
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.4.0
>
>
> hadoop-auth has a dependency on net.minidev:json-smart 2.4.7, but this
> dependency is never used.
> This dependency was originally included because the transitive dependency
> that nimbus-jose-jwt had did not work properly (see
> https://issues.apache.org/jira/browse/HADOOP-14903). Since version 9.*
> nimbus-jose-jwt is using its own shaded version of json-smart, so the version
> declared in hadoop-auth is never actually used.
> json-smart 2.4.7 shows up in CVE scans for CVE-2023-1370. It is still used as
> a transitive dependency in hadoop-hdfs
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
