xavifeds8 commented on code in PR #8453:
URL: https://github.com/apache/hbase/pull/8453#discussion_r3556409198
##########
pom.xml:
##########
@@ -1876,6 +1875,25 @@
<type>pom</type>
<scope>import</scope>
</dependency>
+ <dependency>
+ <groupId>io.netty</groupId>
+ <artifactId>netty-all</artifactId>
+ <version>${netty4.version}</version>
Review Comment:
Good catch, you're right.
So currently 4.1.131.Final which has the CVEs in the DNS resolver modules.
The proper fix would actually be to upgrade hbase-thirdparty 4.1.15 which is
not yet released yet. which includes Netty 4.1.135.Final which has these CVEs
resolved for netty-resolver-dns. So ideally once hbase-thirdparty 4.1.15 is
out, we just consume that and this whole workaround becomes unnecessary.
given the classpath conflicts that comes up when mixing direct Netty
dependencies with the shaded path i think it make sense to close this pr. We
could bump up netty when thirdparty gets released.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
