Guosmilesmile commented on code in PR #17336:
URL: https://github.com/apache/iceberg/pull/17336#discussion_r3639433808
##########
spark/v3.5/build.gradle:
##########
@@ -30,9 +30,9 @@ configure(sparkProjects) {
configurations {
all {
resolutionStrategy {
- force
"com.fasterxml.jackson.module:jackson-module-scala_${scalaVersion}:${libs.versions.jackson215.get()}"
- force
"com.fasterxml.jackson.core:jackson-databind:${libs.versions.jackson215.get()}"
- force
"com.fasterxml.jackson.core:jackson-core:${libs.versions.jackson215.get()}"
+ force
"com.fasterxml.jackson.module:jackson-module-scala_${scalaVersion}:${libs.versions.jackson221.get()}"
+ force
"com.fasterxml.jackson.core:jackson-databind:${libs.versions.jackson221.get()}"
+ force
"com.fasterxml.jackson.core:jackson-core:${libs.versions.jackson221.get()}"
Review Comment:
> If we do this, do we need the GHSA-r7wm-3cxj-wff9 in
spark-runtime-3.5.trivyignore?
Yes, so I remove GHSA-r7wm-3cxj-wff9 in spark-runtime-3.5.trivyignore.
> Also, how sure are we that Spark works with a different fasterxml version?
Good question. Since `com.fasterxml` is relocated to
`org.apache.iceberg.shaded.com.fasterxml`(relocate 'com.fasterxml',
'org.apache.iceberg.shaded.com.fasterxml'), the Jackson copy included in the
Iceberg runtime jar is isolated from Spark's own Jackson jars and should not
override them.
I verified dependency resolution for Spark 3.5 and it now resolves
`jackson-core`, `jackson-databind`, and `jackson-module-scala_2.12` to 2.21.4.
However, that is not a full compatibility guarantee, so we should validate
this with Spark 3.5 tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
