[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-07 Thread Jiabao Sun (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17834779#comment-17834779
 ] 

Jiabao Sun commented on FLINK-34955:


I have rechecked the dependency of `commons-codec` in `commons-compress` and it 
is no longer optional. Even if upgraded to 1.26.1, `commons-codec` will still 
be a transitive dependency. 
Sorry for the disturbance.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-07 Thread Zhongqiang Gong (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17834750#comment-17834750
 ] 

Zhongqiang Gong commented on FLINK-34955:
-

Hi [~slfan1989]  ,I apologize for the ambiguity. `{color:#c1c7d0}remove 
commons-codec dependence{color}`  means  `{color:#c1c7d0}we don't have to 
manually add a dependency to commons-codec.{color}` .

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-07 Thread Shilun Fan (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17834682#comment-17834682
 ] 

Shilun Fan commented on FLINK-34955:


[~gongzhongqiang] Of course, if upgrading is possible, it would be a positive 
step forward. I think we should give it a try. I see that you have created the 
relevant JIRA ticket, so you can go ahead and attempt it. Hopefully, it will be 
successful.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-07 Thread Shilun Fan (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17834681#comment-17834681
 ] 

Shilun Fan commented on FLINK-34955:


[~gongzhongqiang] From my personal perspective, I believe upgrading to version 
1.26.0 should be sufficient as this version has already fixed the CVE issue. As 
for upgrading to 1.26.1, I think we can consider it after some time. Removing 
commons-codec might prove to be challenging because Flink has dependencies on 
Hadoop and HBase (both of which directly depend on commons-codec). If we remove 
commons-codec, it may result in the Hadoop and HBase modules being unable to 
compile successfully.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-07 Thread Zhongqiang Gong (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17834678#comment-17834678
 ] 

Zhongqiang Gong commented on FLINK-34955:
-

[~slfan1989] [~mbalassi] According to 
https://issues.apache.org/jira/browse/COMPRESS-659 , [~jiabaosun]  and I think 
it's better bump version to 1.26.1 and remove `commons-codec` dependence.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-03 Thread Jira 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17833561#comment-17833561
 ] 

Márton Balassi commented on FLINK-34955:


[{{f172171}}|https://github.com/apache/flink/commit/f17217100cf7d28bf6a1b687427c01e30b77e900]
 in release-1.19 and 
[{{1711ba8}}|https://github.com/apache/flink/commit/1711ba85744d917ca63d989bf4c120c6aebda9ba]
 in release-1.18.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-04-02 Thread Jira 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17833201#comment-17833201
 ] 

Márton Balassi commented on FLINK-34955:


[163b9cc|https://github.com/apache/flink/commit/163b9cca6d2ccac0ff89dd985e3232667ddfb14f]
 in master, creating necessary backports.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Assignee: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
> Fix For: 1.18.2, 1.20.0, 1.19.1
>
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (FLINK-34955) Upgrade commons-compress to 1.26.0

2024-03-28 Thread Jira 


[ 
https://issues.apache.org/jira/browse/FLINK-34955?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17831639#comment-17831639
 ] 

Márton Balassi commented on FLINK-34955:


Thanks! Let us get this in quick and backport it to 1.19 and 1.18.

> Upgrade commons-compress to 1.26.0
> --
>
> Key: FLINK-34955
> URL: https://issues.apache.org/jira/browse/FLINK-34955
> Project: Flink
>  Issue Type: Improvement
>Reporter: Shilun Fan
>Priority: Major
>  Labels: pull-request-available
>
> commons-compress 1.24.0 has CVE issues, try to upgrade to 1.26.0, we can 
> refer to the maven link
> https://mvnrepository.com/artifact/org.apache.commons/commons-compress



--
This message was sent by Atlassian Jira
(v8.20.10#820010)