Skip to content

Dependency Version Fixes: Woodstox 6.4.0, Scala-lang 2.13.9, Jackson-Databind 2.14.0, Kafka-clients 3.0.2 #2269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DarshitChanpura merged 7 commits into from
Nov 29, 2022
Merged

Dependency Version Fixes: Woodstox 6.4.0, Scala-lang 2.13.9, Jackson-Databind 2.14.0, Kafka-clients 3.0.2 #2269

Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9a72120
Force woodstox to 6.4.0
stephen-crawford Nov 21, 2022
e9b3c94
Dependency bumps
stephen-crawford Nov 21, 2022
80ff882
Fix netty versions
stephen-crawford Nov 21, 2022
ed5634f
Fix netty versions
stephen-crawford Nov 21, 2022
7290895
Remove extra dependenciy forces
stephen-crawford Nov 21, 2022
12b79f4
Readd snakeyaml and netty
stephen-crawford Nov 21, 2022
c05dd6b
Remove netty and snakeyaml
stephen-crawford Nov 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,14 @@ configurations.all {
force "org.apache.commons:commons-lang3:3.4"
force "org.springframework:spring-core:5.3.20"
force "com.google.guava:guava:30.0-jre"
force "com.fasterxml.woodstox:woodstox-core:6.4.0"
force "org.scala-lang:scala-library:2.13.9"
force "org.yaml:snakeyaml:1.32"
Comment thread
stephen-crawford marked this conversation as resolved.
Outdated
force 'io.netty:netty-buffer:4.1.78.Final'

@cwperks cwperks Nov 21, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to force the resolution of the netty version here?

@stephen-crawford stephen-crawford Nov 21, 2022

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There was a netty cve in the previous push without the netty change. I know that in later versions we have a netty.version variable but this does not seem to exist for 1.x.

@DarshitChanpura DarshitChanpura Nov 21, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO, this should be fine even without adding it as a force resolution but I don't see any harm in it being added here too.

See https://docs.gradle.org/current/dsl/org.gradle.api.artifacts.ResolutionStrategy.html

@stephen-crawford stephen-crawford Nov 21, 2022

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think I may have seen the CVE for 1.3 on Netty and then because I just copy+pasted the same changes it may have been included. I can remove it if you think I should but I imagine keeping it is not a bad idea either.

@cwperks cwperks Nov 21, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

netty is set to 4.1.79.Final 4.1.84.Final for core, can this version match the version from core?

Note the SNAPSHOT may be outdated, this is the version in core's version.properties in 1.3: https://github.com/opensearch-project/OpenSearch/blob/1.3/buildSrc/version.properties#L22

runtimeClasspath - Runtime classpath of source set 'main'.
+--- jakarta.annotation:jakarta.annotation-api:1.3.5
+--- org.opensearch.plugin:transport-netty4-client:1.3.6-SNAPSHOT
|    +--- io.netty:netty-buffer:4.1.79.Final
|    +--- io.netty:netty-codec:4.1.79.Final
|    +--- io.netty:netty-codec-http:4.1.79.Final
|    +--- io.netty:netty-common:4.1.79.Final
|    +--- io.netty:netty-handler:4.1.79.Final
|    +--- io.netty:netty-resolver:4.1.79.Final
|    +--- io.netty:netty-transport:4.1.79.Final
|    \--- io.netty:netty-transport-native-unix-common:4.1.79.Final

Does dependabot pick up on stale versions in this section?

I think snakeyaml is unnecessary here, its coming from opensearch dependencies that have already been patched. snakeyaml comes to security via org.opensearch:opensearch-x-content:1.3.6-SNAPSHOT and its been upgraded to 1.32 in the latest snapshot.

@stephen-crawford stephen-crawford Nov 21, 2022

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright I can remove snakeyaml and then swap netty to be 79

force 'io.netty:netty-common:4.1.78.Final'
force 'io.netty:netty-handler:4.1.78.Final'
force 'io.netty:netty-transport:4.1.78.Final'

}
}

Expand All @@ -81,7 +89,7 @@ dependencies {
implementation 'org.greenrobot:eventbus:3.2.0'
implementation 'commons-cli:commons-cli:1.3.1'
implementation 'org.bouncycastle:bcprov-jdk15on:1.67'
implementation 'com.fasterxml.jackson.core:jackson-databind:2.13.2.2'
implementation 'com.fasterxml.jackson.core:jackson-databind:2.14.0'
implementation 'org.slf4j:slf4j-api:1.7.32'
implementation 'org.ldaptive:ldaptive:1.2.3'
implementation 'org.apache.httpcomponents:httpclient-cache:4.5.13'
Expand All @@ -91,7 +99,7 @@ dependencies {
}
implementation 'com.github.wnameless:json-flattener:0.5.0'
implementation 'com.flipkart.zjsonpatch:zjsonpatch:0.4.4'
implementation 'org.apache.kafka:kafka-clients:3.0.1'
implementation 'org.apache.kafka:kafka-clients:3.0.2'
implementation 'com.onelogin:java-saml:2.5.0'
implementation ('org.opensaml:opensaml-saml-impl:3.4.5') {
exclude(group: 'org.apache.velocity', module: 'velocity')
Expand Down