Upgrade guava from 22.0 to 33.3.0-jre - #6759
Open
Akanksha-kedia wants to merge 3 commits into
Open
Akanksha-kedia wants to merge 3 commits into
Akanksha-kedia wants to merge 3 commits into
Conversation
22.0 (2017) predates fixes for known Guava CVEs (e.g. CVE-2020-8908, CVE-2023-2976, both involving Files.createTempDir() creating a world-readable/writable temp directory). Guava stopped publishing unsuffixed artifacts after 22.0, so the version property now carries the -jre classifier directly, since every module in this repo declares the bare "guava" artifactId and relies on ${guava.version} to supply it. Checked for the most common cross-version breakage pattern before bumping: every Futures.addCallback(...) call site in this repo already uses the 3-arg form with an explicit Executor, so the 2-arg overload removed in later Guava versions isn't affected. Could not run a full build in this environment to compile-verify beyond that, so extra CI scrutiny on this one would be appreciated.
Jenkins pr-head returned a generic infra error (state=ERROR, "This commit cannot be built") on the previous commit while GitHub Actions build checks passed cleanly on the same code - unrelated to this change. Empty commit to force a fresh webhook-triggered build.
asf-ci-hive
added
tests pending
tests failed
and removed
tests failed
tests pending
labels
Contributor
Author
Jenkins pr-head is still stuck in state=ERROR after the previous retrigger attempt. Empty commit to force another fresh webhook build.
|
Member
|
this has been attempted a lot of time @Akanksha-kedia and this isn't just a POM change, Half the problems are not solvable due to thirdparty issues, Hadoop took that hadoop-thirdparty route for Guava, Maybe one day we will do the same for Hive... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Bumps the
guava.versionproperty from22.0to33.3.0-jre. Every module in this repo declares the bareguavaartifactId with no-jre/-androidclassifier and relies on${guava.version}to supply it — Guava stopped publishing unsuffixed artifacts after 22.0, so the new version carries the-jresuffix directly in the property value.Why are the changes needed?
22.0 was released in 2017 and predates fixes for known Guava CVEs, including CVE-2020-8908 and CVE-2023-2976, both involving
Files.createTempDir()creating a world-readable/writable temporary directory.Does this PR introduce any user-facing change?
No.
How was this patch tested?
Checked the most common cross-major-version Guava breakage pattern before bumping: every
Futures.addCallback(...)call site in this repo already uses the 3-argument form with an explicitExecutor, so the 2-argument overload removed in later Guava versions doesn't affect this codebase. Also confirmed nodependencyConvergence/requireUpperBoundDepsenforcer rule would block on this. Could not run a full Maven build in my environment to compile-verify beyond that — appreciate extra CI/review scrutiny here given the size of the version jump.