Akanksha-kedia opened a new pull request, #6754: URL: https://github.com/apache/hive/pull/6754
## What changes were proposed in this pull request? Adds `org.apache.commons:commons-configuration2:2.15.0` as a dependency in `ql/pom.xml` (property declared in root `pom.xml`), alongside the existing `commons-configuration:commons-configuration:1.10` dependency, which is left untouched. This picks up the thread from #5213, which proposed migrating `commons-configuration` 1.x to `commons-configuration2` but stalled after review. ## Why are the changes needed? #5213 aimed to fix CVEs in commons-configuration 1.x by moving to config2. However, the only two consumers in this repo — `AtlasRestClientBuilder.java` and `TestAtlasDumpTask.java` — feed `org.apache.atlas.ApplicationProperties.set(Configuration)`, and Atlas 2.4.0's API (pinned in `ql/pom.xml`) hardcodes `org.apache.commons.configuration.Configuration` (config1). Swapping those call sites to config2's `ConfigurationConverter` does not compile against that Atlas API, and since Atlas itself depends on config1 internally, the vulnerable jar stays on the classpath transitively regardless of what Hive declares directly — a full fix needs an Atlas client upgrade as well, which is out of scope here. This PR only adds the config2 dependency so it's available, without touching the Atlas-coupled call sites, so as not to break the build while that larger Atlas upgrade is out of scope. ## Does this PR introduce any user-facing change? No. ## How was this patch tested? `mvn install -DskipTests -pl ql -am` — dependency resolves and `ql` compiles cleanly with commons-configuration2 added alongside the existing commons-configuration 1.x dependency. cc @ayushtkn @devaspatikrishnatri -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
