JiaLiangC opened a new pull request, #4208: URL: https://github.com/apache/ambari/pull/4208
## What changes were proposed in this pull request? https://issues.apache.org/jira/browse/AMBARI-26653 Several runtime dependencies still use vulnerable versions, and server and agent overrides prevent consistent upgrades. This PR contains five topic commits, with focused tests alongside the behavior they verify: - Upgrade managed BeanUtils 1.9.4 to 1.11.0 and verify enum class access is suppressed while ordinary bean copying works (Dependabot #4021). - Remove unused Jettison 1.1 dependency management and the server dependency, retain the protective exclusion, and remove obsolete test exception declarations (#3667). - Align Commons Compress at 1.28.0 in server and agent. Remove the agent's Commons IO override so both modules inherit compatible IO 2.21.0. Cover actual configuration archive round trips and truncated gzip rejection. The agent already contains #4001's 1.26.0 fix; the server was still at 1.21. - Upgrade agent Configuration2 to 2.15.0 and its Commons Logging prerequisite to 1.3.6, with existing credential-store and ZooKeeper tests (#4136). - Align Jackson BOM, core, databind, and related modules at 2.18.9. Cover number-length enforcement across asynchronous input chunks and rejection of a case-insensitive protected-property bypass (#4152, #4153). These changes remediate dependencies; an exploitable Ambari endpoint is not claimed solely from library versions. Agent Configuration2's optional YAML support is not packaged. The server's separate Hadoop-transitive Configuration2 2.1.1 remains a follow-up, along with unrelated framework, database, and frontend upgrades. ## How was this patch tested? On macOS with JDK 17.0.19 and Maven 3.9.11, the combined focused lifecycle passed **66 tests, zero failures/errors** (51 server, 15 agent): ```shell env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -pl ambari-server,ambari-agent -Dtest=CommonsBeanUtilsSecurityTest,JacksonSecurityTest,ClientConfigArchiveTest,ClientConfigResourceProviderTest,MpackResourceProviderTest,ExecutionCommandWrapperTest,BootStrapResourceTest,JsonRequestBodyParserTest,JsonSerializerTest,CredentialStoreCreateTest,ZkMigratorTest -DfailIfNoTests=false -DskipPythonTests=true test ``` The final dependency audit passed for server, agent, and utility. It confirms BeanUtils 1.11.0, Compress 1.28.0, aligned Jackson 2.18.9 artifacts, agent Configuration2 2.15.0, and no resolved Jettison: ```shell env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -pl ambari-server,ambari-agent,ambari-utility -DskipTests -Dscope=runtime '-Dincludes=commons-beanutils:commons-beanutils,org.codehaus.jettison:jettison,org.apache.commons:commons-compress,org.apache.commons:commons-configuration2,com.fasterxml.jackson.*:*' dependency:tree ``` The same compiled Jupiter security tests were also run against explicit old and new library classpaths. BeanUtils 1.9.4 fails the enum protection test, while 1.11.0 passes both tests. Jackson 2.18.2 fails both security assertions but passes the valid-number control; 2.18.9 passes all three tests. `git diff --check` passed. The five topic patches replay cleanly from trunk 474f6711c1 and reproduce the exact tested tree. Python tests were explicitly skipped in successful runs: an initial attempt including Python failed when a Linux cryptography native module was loaded on macOS. The full repository suite and packaged deployment tests were not run. Please review [Ambari Contributing Guide](https://cwiki.apache.org/confluence/display/AMBARI/How+to+Contribute) before opening a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
