anupamme commented on code in PR #57779:
URL: https://github.com/apache/spark/pull/57779#discussion_r3742745916
##########
hadoop-cloud/pom.xml:
##########
@@ -197,24 +189,8 @@
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-tos</artifactId>
</exclusion>
- <exclusion>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-huaweicloud</artifactId>
- </exclusion>
Review Comment:
`hadoop-huaweicloud` has been unmaintained since 2021 and pulls in `okhttp
3.x` (CVE-2021-0341). Exclude it to keep the vulnerable dependency off the
classpath. `hadoop-cloud-storage` declares `hadoop-huaweicloud` as a transitive
dependency; if we don't exclude it, Maven will pull it back in automatically
even though we removed the direct dependency. The exclusion is what actually
keeps `okhttp/okio` (and the CVE) out of the classpath.
PR Title updated to the JIRA ticket number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
