[
https://issues.apache.org/jira/browse/HBASE-22109?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16802819#comment-16802819
]
Sean Busbey commented on HBASE-22109:
-------------------------------------
{quote}
And we already include the 27.0-jre guava if we enable the errorProne plugin,
as the error prone stuffs depend on it. And Andrew Purtell has reported that it
will fail the assembly build because of the LICENSE problem. So I think at
least we can fix the LICENSE problem first...
{quote}
fixing the name of the new license should fix things if they fail for the same
reason when the errorProne plugin is enabled. (though this sounds like crappy
behavior on its part)
{quote}
We shade guava in our hbase-thirdparty. So we need to publish a new release of
hbase-thirdparty and then make hbase depend on the new version of
hbase-thirdparty.
{quote}
Right. So probably a different JIRA to track that work. Anyone have a chance to
look at the CVE yet?
> Update hbase shaded content checker after guava update in hadoop branch-3.0
> to 27.0-jre
> ---------------------------------------------------------------------------------------
>
> Key: HBASE-22109
> URL: https://issues.apache.org/jira/browse/HBASE-22109
> Project: HBase
> Issue Type: Improvement
> Affects Versions: 3.0.0
> Reporter: Gabor Bota
> Assignee: Gabor Bota
> Priority: Minor
> Attachments: HBASE-22109.001.patch
>
>
> I'm updating guava version from 11.0.2 to 27.0-jre in HADOOP-15960 because of
> a CVE. I will create a patch for branch-3.0, 3.1, 3.2 and trunk (3.3).
> I wanted to be sure that HBase works with the updated guava, I compiled and
> run the HBase tests with my hadoop snapshot containing the updated version,
> but there were some issues that I had to fix:
> * New shaded dependency: org.checkerframework
> * New license needs to be added to LICENSE.vm: Apache 2.0
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
