[GitHub] [hadoop] virajjasani commented on pull request #2895: HADOOP-17633. Bump json-smart to 2.4.2 due to CVEs

2021-04-13 Thread GitBox
virajjasani commented on pull request #2895: URL: https://github.com/apache/hadoop/pull/2895#issuecomment-818917758 FYI @ayushtkn @jojochuang -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to

[GitHub] [hadoop] virajjasani commented on pull request #2895: HADOOP-17633. Bump json-smart to 2.4.2 due to CVEs

2021-04-13 Thread GitBox
virajjasani commented on pull request #2895: URL: https://github.com/apache/hadoop/pull/2895#issuecomment-818903880 `json-smart` is used directly by hadoop-auth and through hadoop-auth, it is used by multiple modules as transitive dependency in hadoop-common, hadoop-nfs, hadoop-hdfs,

[GitHub] [hadoop] virajjasani commented on pull request #2895: HADOOP-17633. Bump json-smart to 2.4.2 due to CVEs

2021-04-13 Thread GitBox
virajjasani commented on pull request #2895: URL: https://github.com/apache/hadoop/pull/2895#issuecomment-818678822 @steveloughran I have run tests locally for some affected modules and they seem fine. However, this PR's build seems to be stuck (build#2 is still not over after 17+

[GitHub] [hadoop] virajjasani commented on pull request #2895: HADOOP-17633. Bump json-smart to 2.4.2 due to CVEs

2021-04-13 Thread GitBox
virajjasani commented on pull request #2895: URL: https://github.com/apache/hadoop/pull/2895#issuecomment-818578359 ``` [INFO] org.apache.hadoop:hadoop-minikdc:jar:3.4.0-SNAPSHOT [INFO] +- commons-io:commons-io:jar:2.5:compile [INFO] +-

[GitHub] [hadoop] virajjasani commented on pull request #2895: HADOOP-17633. Bump json-smart to 2.4.2 due to CVEs

2021-04-13 Thread GitBox
virajjasani commented on pull request #2895: URL: https://github.com/apache/hadoop/pull/2895#issuecomment-818572599 I just tested locally and realized that `nimbus-jose-jwt` 9.8 does not even produce `json-smart` hence all the places where we have excluded `json-smart` from