The GitHub Actions job "maven in /. for com.google.guava:guava - Update 
#1664056750" on hive.git/master has failed.
Run started by GitHub user dependabot[bot] (triggered by dependabot[bot]).

Head commit for run:
4e0ed4254f298221ad48fbda85f2d682e6763455 / Stamatis Zampetakis 
<[email protected]>
HIVE-28978: Remove explicit json-path dependency declaration (#6929)

The json-path dependency is coming from Calcite and its only used by the 
respective code.
Pinning down the json-path version to 2.9.0 in Hive leads to version 
misalignment since
the current version of Calcite uses json-path 2.10.0.
A side-effect of the version pindown is to get stack with obsolete and insecure 
transitive
depenencies, such as json-smart:2.5.0, that are not even used in Hive.

In order to avoid version inconsistencies and inclusion of obsolete and 
insecure deps in
the Hive runtime we opt to bundle the json-path dependency in the shaded jar. 
This ensures
the correct json-path (as defined by Calcite) is used at runtime while its 
unused
transitive dependencies (json-smart, accessors-smart) are dropped from the 
dependency tree.

Report URL: https://github.com/apache/hive/actions/runs/40955332338

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to