[SPARK-29483][BUILD] Bump Jackson to 2.10.0 #26131
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fokko
changed the title
Member
|
ok to test |
Member
dongjoon-hyun
changed the title
Member
|
BTW, @Fokko . We use |
srowen
requested changes
Oct 15, 2019
| jackson-module-jaxb-annotations-2.10.0.jar | ||
| jackson-module-paranamer-2.10.0.jar | ||
| jackson-module-scala_2.12-2.10.0.jar | ||
| jakarta.activation-api-1.2.1.jar |
Member
There was a problem hiding this comment.
We'll need an entry in LICENSE-binary for this, under the Eclipse Dist License section. (We seem to already have a copy of the license though in licenses-binary).
Contributor
Author
There was a problem hiding this comment.
Done, thanks for pointing out
|
Test build #112125 has finished for PR 26131 at commit
|
|
Test build #112152 has finished for PR 26131 at commit
|
|
Test build #4898 has finished for PR 26131 at commit
|
Member
|
Could you make a back porting PR, @Fokko ? |
Member
|
cc @jiangxb1987 since he is the release manager for |
Member
|
Not a back port to 2.4 right? We can't update Jackson in 2.4. I don't think we have to back port to the preview branch, even if we keep it. |
Member
|
Oh, I see. Got it, @srowen . |
Contributor
|
@srowen What's the issue in upgrading Jackson in 2.4? |
Contributor
Author
|
@krishna-pandey please refer to #21596 Jackson is notorious for having to change their public API, and aggressively deprecating methods. This will conflict with older versions of Hadoop. This might have huge implications for your application. |
mccheah
pushed a commit
to palantir/spark
that referenced
this pull request
Nov 26, 2019
Release blog: https://medium.com/cowtowncoder/jackson-2-10-features-cd880674d8a2 Fixes the following CVE's: https://www.cvedetails.com/cve/CVE-2019-16942/ https://www.cvedetails.com/cve/CVE-2019-16943/ Looking back, there were 3 major goals for this minor release: - Resolve the growing problem of “endless CVE patches”, a stream of fixes for reported CVEs related to “Polymorphic Deserialization” problem (described in “On Jackson CVEs… ”) that resulted in security tools forcing Jackson upgrades. 2.10 now includes “Safe Default Typing” that is hoped to resolve this problem. - Evolve 2.x API towards 3.0, based on changes that were done in master, within limits of 2.x API backwards-compatibility requirements. - Add JDK support for versions beyond Java 8: specifically add“module-info.class” for JDK9+, defining proper module definitions for Jackson components Full changelog: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10 Improved Scala 2.13 support: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10#scala Patches CVE's reported by the vulnerability scanner. No Ran `mvn clean install -DskipTests` locally. Closes apache#26131 from Fokko/SPARK-29483. Authored-by: Fokko Driesprong <[email protected]> Signed-off-by: Dongjoon Hyun <[email protected]>
robert3005
pushed a commit
to palantir/spark
that referenced
this pull request
Dec 4, 2019
Release blog: https://medium.com/cowtowncoder/jackson-2-10-features-cd880674d8a2 Fixes the following CVE's: https://www.cvedetails.com/cve/CVE-2019-16942/ https://www.cvedetails.com/cve/CVE-2019-16943/ Looking back, there were 3 major goals for this minor release: - Resolve the growing problem of “endless CVE patches”, a stream of fixes for reported CVEs related to “Polymorphic Deserialization” problem (described in “On Jackson CVEs… ”) that resulted in security tools forcing Jackson upgrades. 2.10 now includes “Safe Default Typing” that is hoped to resolve this problem. - Evolve 2.x API towards 3.0, based on changes that were done in master, within limits of 2.x API backwards-compatibility requirements. - Add JDK support for versions beyond Java 8: specifically add“module-info.class” for JDK9+, defining proper module definitions for Jackson components Full changelog: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10 Improved Scala 2.13 support: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10#scala Patches CVE's reported by the vulnerability scanner. No Ran `mvn clean install -DskipTests` locally. Closes apache#26131 from Fokko/SPARK-29483. Authored-by: Fokko Driesprong <[email protected]> Signed-off-by: Dongjoon Hyun <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Release blog: https://medium.com/@cowtowncoder/jackson-2-10-features-cd880674d8a2
Fixes the following CVE's:
https://www.cvedetails.com/cve/CVE-2019-16942/
https://www.cvedetails.com/cve/CVE-2019-16943/
Looking back, there were 3 major goals for this minor release:
Full changelog: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10
Improved Scala 2.13 support: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10#scala
Why are the changes needed?
Patches CVE's reported by the vulnerability scanner.
Does this PR introduce any user-facing change?
No
How was this patch tested?
Ran
mvn clean install -DskipTestslocally.