I had to revert Jackson from 2.13.1 back to 2.12.4 in one of our internal repos for this same problem. We noticed CNFEs in REST unit tests. It didn’t occur to me it might be a problem in open source, because the internal tree is a 1.x version.
We should figure out what additional dependencies must be explicitly added now or the next time Jackson has a security issue we will have to deal with it then. I can look at this Monday if you don’t have time before then. I agree we should bring all of Jackson in to thirdparty. > On Mar 5, 2022, at 4:34 PM, 张铎 <[email protected]> wrote: > > OK, this is because we have upgraded jackson in hbase-thirdparty to 2.13.1 > while in the main repo we are still on 2.10.1. > > I've upgraded the dependency in the main repo to 2.13.1 too. > > Let's see if it works. And maybe we should shade all jackson related jars > in hbase-thirdparty in the future? > > 张铎(Duo Zhang) <[email protected]> 于2022年3月6日周日 08:20写道： > >> https://github.com/apache/hbase/pull/4164 >> >> In this PR, all the UTs in rest fail with ClassNotFound. >> >> Seems we missed some classes when shading hbase-thirdparty. >> >> Will dig more. >> >> Andrew Purtell <[email protected]> 于2022年3月5日周六 03:04写道： >> >>> +1 (binding) >>> >>> * Signature: ok >>> * Checksum : ok >>> * Rat check (1.8.0_322): ok >>> - mvn clean apache-rat:check >>> * Built from source (1.8.0_322): ok >>> - mvn clean install -DskipTests >>> * Unit tests for new hbase-unsafe module (1.8.0_322): ok >>> - ( cd hbase-unsafe && mvn clean install ) >>> >>> >>> >>> On Fri, Mar 4, 2022 at 8:25 AM 张铎(Duo Zhang) <[email protected]> >>> wrote: >>> >>>> Please vote on this Apache hbase thirdparty release candidate, >>>> hbase-thirdparty-4.1.0RC0 >>>> >>>> The VOTE will remain open for at least 72 hours. >>>> >>>> [ ] +1 Release this package as Apache hbase thirdparty 4.1.0 >>>> [ ] -1 Do not release this package because ... >>>> >>>> The tag to be voted on is 4.1.0RC0: >>>> >>>> https://github.com/apache/hbase-thirdparty/tree/4.1.0RC0 >>>> >>>> This tag currently points to git reference >>>> >>>> c120582f161149e0c8a6b2ec134b5bf22d859a21 >>>> >>>> The release files, including signatures, digests, as well as CHANGES.md >>>> and RELEASENOTES.md included in this RC can be found at: >>>> >>>> >>> https://dist.apache.org/repos/dist/dev/hbase/hbase-thirdparty-4.1.0RC0/ >>>> >>>> Maven artifacts are available in a staging repository at: >>>> >>>> >>> https://repository.apache.org/content/repositories/orgapachehbase-1482/ >>>> >>>> Artifacts were signed with the 9AD2AE49 key which can be found in: >>>> >>>> https://downloads.apache.org/hbase/KEYS >>>> >>>> To learn more about Apache hbase thirdparty, please see >>>> >>>> http://hbase.apache.org/ >>>> >>>> Thanks, >>>> Your HBase Release Manager >>>> >>> >>> >>> -- >>> Best regards, >>> Andrew >>> >>> Unrest, ignorance distilled, nihilistic imbeciles - >>> It's what we’ve earned >>> Welcome, apocalypse, what’s taken you so long? >>> Bring us the fitting end that we’ve been counting on >>> - A23, Welcome, Apocalypse >>> >>
