[
https://issues.apache.org/jira/browse/HADOOP-18496?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17756040#comment-17756040
]
ASF GitHub Bot commented on HADOOP-18496:
-----------------------------------------
ashutoshcipher commented on PR #5139:
URL: https://github.com/apache/hadoop/pull/5139#issuecomment-1684117467
Hi
I agree to what you are saying, but it's not really something I introduced
but was already present before
On Fri, 18 Aug, 2023, 4:52 pm PJ Fanning, ***@***.***> wrote:
> @ashutoshcipher <https://github.com/ashutoshcipher> this might be
> controversial but I think that Hadoop has too many lib dependencies. I
> think it would be better to use simpler dependencies like Apache HttpClient
> than to use very complicated dependencies like okhttp with its Kotlin
> runtime dependencies.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/hadoop/pull/5139#issuecomment-1684113240>, or
> unsubscribe
>
<https://github.com/notifications/unsubscribe-auth/AEGB5KLQCPRTLXQILLRMLADXV6FUBANCNFSM6AAAAAASCIHGAQ>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
> upgrade kotlin-stdlib due to CVEs
> ---------------------------------
>
> Key: HADOOP-18496
> URL: https://issues.apache.org/jira/browse/HADOOP-18496
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
> Labels: pull-request-available
>
> I'm not an expert on Kotlin but dependabot show these 2 CVEs with the version
> of kotlin-stdlib used in Hadoop.
> * [https://github.com/advisories/GHSA-cqj8-47ch-rvvq]
> * [https://github.com/advisories/GHSA-2qp4-g3q3-f92w]
> kotlin-stlib 1.6.0 is the minimum version needed to fix both. It might be
> better to use latest v1.6 jar (currently 1.6.21) or even use latest jar
> altogether (currently 1.7.20).
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
