[ 
https://issues.apache.org/jira/browse/HADOOP-19912?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106637#comment-18106637
 ] 

ASF GitHub Bot commented on HADOOP-19912:
-----------------------------------------

joseluisll commented on PR #8653:
URL: https://github.com/apache/hadoop/pull/8653#issuecomment-5370475919

   > Could we use LLM to search the codebase and list all components that might 
need to be migrated?
   > 
   > As you know, we went through a painful Jersey 1.x => 2.x upgrade process, 
and even now, we're still receiving some issues caused by the Jersey upgrade. 
This means that the current branch-3.5 is unstable (branch-3.5 has only 
released one version, 3.5.0), and we're still far from 3.6.0. Merging this 
change now might not be a good time (meaning the 3.5 backport could have a lot 
of conflicts).
   > 
   > This change will be a breaking change for all downstream projects of 
Hadoop (perhaps Spark is an exception because it uses the Hadoop Shaded 
Client). We may need to initiate a cross-project discussion on the mailing list 
and try to reach a consensus before moving forward.
   
   I can help with the LLM part. Using Claude, I asked for a script to scan the 
codebase and an analysis of the migration viability. Please have a look at the 
attached analysis document. 
   
[hadoopjetty12migration.pdf](https://github.com/user-attachments/files/31307646/hadoopjetty12migration.pdf)




> Upgrade to Jetty 12
> -------------------
>
>                 Key: HADOOP-19912
>                 URL: https://issues.apache.org/jira/browse/HADOOP-19912
>             Project: Hadoop Common
>          Issue Type: Task
>            Reporter: PJ Fanning
>            Priority: Major
>              Labels: pull-request-available
>
> See HADOOP-19910 - there is a CVE in Jetty but releases of 9.4 are rare and 
> are 'sponsored' - Jetty 9.4 is not actively maintained. There are some 
> commercial forks.
> Jetty 12 needs Java 17+.
> Will also force Jersey to upgraded to 3 or 4.
> And to replace many javax classes/jars with their jakarta equivalents.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to