Martijn Visser created FLINK-41488:
--------------------------------------
Summary: Bump OpenLineage, Guava, jackson-bom and the Spanner
driver, and remove unneeded dependency pins
Key: FLINK-41488
URL: https://issues.apache.org/jira/browse/FLINK-41488
Project: Flink
Issue Type: Technical Debt
Components: Connectors / JDBC
Reporter: Martijn Visser
Assignee: Martijn Visser
Dependabot opened apache/flink-connector-jdbc#269 ({{snappy-java}} 1.1.10.4 to
1.1.10.9) and #270 ({{guava}} 33.0.0-jre to 33.7.1-jre). Both change pins in
the root {{dependencyManagement}} that only reach the tests and provided scope,
and 33.7.1-jre is still inside the affected range of GHSA-xxph-c9ww-hj94, which
is fixed in 33.7.2.
The dependency that does reach users is OpenLineage. A project that depends on
{{flink-connector-jdbc-core}} resolves {{jackson-core}} and
{{jackson-databind}} 2.18.9 through {{openlineage-java}} 1.53.0, inside the
affected ranges of GHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89,
GHSA-cxp5-3px4-pw24 and GHSA-wv8q-qhhj-9h54. The {{jackson-bom}} import in our
pom does not reach consumers. {{openlineage}} 1.55.0 brings 2.18.11, which
fixes all four.
One commit each:
* {{openlineage}} 1.53.0 to 1.55.0
* {{jackson-bom}} 2.22.2 to 2.22.4, for the same advisories in the tests
* {{guava}} 33.0.0-jre to 33.8.0-jre
* {{google-cloud-spanner-jdbc}} 2.44.0 to 2.49.0, which moves
{{bcprov-jdk18on}} from 1.80 to 1.85
* Remove the core {{META-INF/NOTICE}}. OpenLineage is a regular dependency, not
bundled, and Flink's license checker reports both entries as "not bundled, but
listed".
* Remove the pins for {{snappy-java}}, {{scala-library}}, {{objenesis}},
{{kryo}}, {{commons-compress}}, {{commons-codec}}, {{httpclient}}, {{httpcore}}
and {{checker-qual}}. The convergence check passes without each of them on
Flink 2.1.3, 2.2.1, 2.3.0 and 2.4-SNAPSHOT. Most held the tests below what
Flink ships, {{snappy-java}} at 1.1.10.4 against Flink's 1.1.10.7, and the
{{com.esotericsoftware.kryo}} pin matches nothing since Flink 2.0. This
supersedes #269.
{{commons-lang3}} stays pinned at 3.18.0, because the two OpenLineage artifacts
ask for different versions and 3.18.0 is what Flink ships.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
