Skip to content
This repository has been archived by the owner on Aug 2, 2022. It is now read-only.

Bump jackson-databind version to 2.10.5.1 #984

Conversation

davidcui1225
Copy link
Contributor

Issue #, if available:
N/A
Description of changes:

  • Bump jackson-databind version to 2.10.5.1 to address CVE for sql
  • Bump jackson-core version to 2.10.5
  • Force integ-test to use jackson-core version 2.10.5
  • Exclude jackson-core from :plugin

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@codecov
Copy link

codecov bot commented Jan 12, 2021

Codecov Report

Merging #984 (e0d0627) into develop (d82fb35) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##             develop     #984   +/-   ##
==========================================
  Coverage      99.87%   99.87%           
  Complexity      2383     2383           
==========================================
  Files            234      234           
  Lines           5470     5470           
  Branches         357      357           
==========================================
  Hits            5463     5463           
  Misses             5        5           
  Partials           2        2           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d82fb35...e0d0627. Read the comment docs.

@@ -31,6 +31,7 @@ thirdPartyAudit.enabled = false
configurations.all {
// conflict with spring-jcl
exclude group: "commons-logging", module: "commons-logging"
exclude group: 'com.fasterxml.jackson.core', module: 'jackson-core'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume this is supposed to be same resolutionStrategy.force as above? Otherwise, although all IT passed, our plugin will have problem at runtime. Please confirm and do sanity test by running all ITs with remote ES cluster with our plugin built from your branch.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reference: ./gradlew integTest -Dtests.rest.cluster=localhost:9200 -Dtests.cluster=localhost:9200 -Dtests.clustername=es-integrationtest -Dtests.class="*SQLCorrectnessIT" -Dhttps=true -Duser=admin -Dpassword=admin in #760

Copy link
Member

@dai-chen dai-chen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix!

@davidcui1225 davidcui1225 merged commit 5d1d858 into opendistro-for-elasticsearch:develop Jan 13, 2021
@davidcui1225 davidcui1225 deleted the cve-jackson-databind branch January 13, 2021 17:17
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants