[ https://issues.apache.org/jira/browse/BEAM-14118?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17550077#comment-17550077 ]
Danny McCormick commented on BEAM-14118: ---------------------------------------- This issue has been migrated to https://github.com/apache/beam/issues/21639 > beam-vendor-grpc-1_43_2 shades vulnerable Netty version > ------------------------------------------------------- > > Key: BEAM-14118 > URL: https://issues.apache.org/jira/browse/BEAM-14118 > Project: Beam > Issue Type: Improvement > Components: runner-flink, runner-spark, sdk-java-harness > Affects Versions: 2.37.0 > Reporter: Arkadiusz Gasinski > Priority: P2 > Labels: stale-P2 > Time Spent: 1h 50m > Remaining Estimate: 0h > > The > [beam-vendor-grpc-1_43_2|https://mvnrepository.com/artifact/org.apache.beam/beam-vendor-grpc-1_43_2] > dependency (that is pulled transitively by the beam-runners-flink-1.13) > shades a vulnerable Netty version, i.e. 4.1.63.Final: > [https://mvnrepository.com/artifact/io.netty/netty-all/4.1.63.Final] > In turn, our Beam pipelines builds are marked as vulnerable and we're having > issues promoting them to higher environments. > Because Netty is shaded, we can't simply override the version in the build > tool. -- This message was sent by Atlassian Jira (v8.20.7#820007)