Skip to content

Commit 1d6036a

Browse files
eugene-cheverdaeugene-cheverda
committed
[fix][sec] Update dependencies to use snakeyaml 2.0 against 3.0
1 parent 7636e89 commit 1d6036a

File tree

5 files changed

+48
-47
lines changed

5 files changed

+48
-47
lines changed

‎distribution/server/src/assemble/LICENSE.bin.txt

+13-13
Original file line numberDiff line numberDiff line change
@@ -246,17 +246,17 @@ The Apache Software License, Version 2.0
246246
* JCommander -- com.beust-jcommander-1.82.jar
247247
* High Performance Primitive Collections for Java -- com.carrotsearch-hppc-0.9.1.jar
248248
* Jackson
249-
- com.fasterxml.jackson.core-jackson-annotations-2.13.4.jar
250-
- com.fasterxml.jackson.core-jackson-core-2.13.4.jar
251-
- com.fasterxml.jackson.core-jackson-databind-2.13.4.2.jar
252-
- com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.13.4.jar
253-
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.13.4.jar
254-
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.13.4.jar
255-
- com.fasterxml.jackson.module-jackson-module-jaxb-annotations-2.13.4.jar
256-
- com.fasterxml.jackson.module-jackson-module-jsonSchema-2.13.4.jar
257-
- com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.13.4.jar
258-
- com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.13.4.jar
259-
- com.fasterxml.jackson.module-jackson-module-parameter-names-2.13.4.jar
249+
- com.fasterxml.jackson.core-jackson-annotations-2.15.0.jar
250+
- com.fasterxml.jackson.core-jackson-core-2.15.0.jar
251+
- com.fasterxml.jackson.core-jackson-databind-2.15.0.2.jar
252+
- com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.15.0.jar
253+
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.15.0.jar
254+
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.15.0.jar
255+
- com.fasterxml.jackson.module-jackson-module-jaxb-annotations-2.15.0.jar
256+
- com.fasterxml.jackson.module-jackson-module-jsonSchema-2.15.0.jar
257+
- com.fasterxml.jackson.datatype-jackson-datatype-jdk8-2.15.0.jar
258+
- com.fasterxml.jackson.datatype-jackson-datatype-jsr310-2.15.0.jar
259+
- com.fasterxml.jackson.module-jackson-module-parameter-names-2.15.0.jar
260260
* Caffeine -- com.github.ben-manes.caffeine-caffeine-2.9.1.jar
261261
* Conscrypt -- org.conscrypt-conscrypt-openjdk-uber-2.5.2.jar
262262
* Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-2.0.1.jar
@@ -321,7 +321,7 @@ The Apache Software License, Version 2.0
321321
- io.netty.incubator-netty-incubator-transport-native-io_uring-0.0.18.Final-linux-x86_64.jar
322322
- io.netty.incubator-netty-incubator-transport-native-io_uring-0.0.18.Final-linux-aarch_64.jar
323323
* Prometheus client
324-
- io.prometheus.jmx-collector-0.16.1.jar
324+
- io.prometheus.jmx-collector-0.18.0.jar
325325
- io.prometheus-simpleclient-0.16.0.jar
326326
- io.prometheus-simpleclient_caffeine-0.16.0.jar
327327
- io.prometheus-simpleclient_common-0.16.0.jar
@@ -402,7 +402,7 @@ The Apache Software License, Version 2.0
402402
- org.eclipse.jetty.websocket-websocket-servlet-9.4.48.v20220622.jar
403403
- org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.48.v20220622.jar
404404
- org.eclipse.jetty-jetty-alpn-server-9.4.48.v20220622.jar
405-
* SnakeYaml -- org.yaml-snakeyaml-1.32.jar
405+
* SnakeYaml -- org.yaml-snakeyaml-2.0.jar
406406
* RocksDB - org.rocksdb-rocksdbjni-7.9.2.jar
407407
* Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.5.1.jar
408408
* Apache Thrift - org.apache.thrift-libthrift-0.14.2.jar

‎distribution/shell/src/assemble/LICENSE.bin.txt

+12-12
Original file line numberDiff line numberDiff line change
@@ -311,17 +311,17 @@ This projects includes binary packages with the following licenses:
311311
The Apache Software License, Version 2.0
312312
* JCommander -- jcommander-1.82.jar
313313
* Jackson
314-
- jackson-annotations-2.13.4.jar
315-
- jackson-core-2.13.4.jar
316-
- jackson-databind-2.13.4.2.jar
317-
- jackson-dataformat-yaml-2.13.4.jar
318-
- jackson-jaxrs-base-2.13.4.jar
319-
- jackson-jaxrs-json-provider-2.13.4.jar
320-
- jackson-module-jaxb-annotations-2.13.4.jar
321-
- jackson-module-jsonSchema-2.13.4.jar
322-
- jackson-datatype-jdk8-2.13.4.jar
323-
- jackson-datatype-jsr310-2.13.4.jar
324-
- jackson-module-parameter-names-2.13.4.jar
314+
- jackson-annotations-2.15.0.jar
315+
- jackson-core-2.15.0.jar
316+
- jackson-databind-2.15.0.2.jar
317+
- jackson-dataformat-yaml-2.15.0.jar
318+
- jackson-jaxrs-base-2.15.0.jar
319+
- jackson-jaxrs-json-provider-2.15.0.jar
320+
- jackson-module-jaxb-annotations-2.15.0.jar
321+
- jackson-module-jsonSchema-2.15.0.jar
322+
- jackson-datatype-jdk8-2.15.0.jar
323+
- jackson-datatype-jsr310-2.15.0.jar
324+
- jackson-module-parameter-names-2.15.0.jar
325325
* Conscrypt -- conscrypt-openjdk-uber-2.5.2.jar
326326
* Gson
327327
- gson-2.8.9.jar
@@ -407,7 +407,7 @@ The Apache Software License, Version 2.0
407407
- websocket-api-9.4.48.v20220622.jar
408408
- websocket-client-9.4.48.v20220622.jar
409409
- websocket-common-9.4.48.v20220622.jar
410-
* SnakeYaml -- snakeyaml-1.32.jar
410+
* SnakeYaml -- snakeyaml-2.0.jar
411411
* Google Error Prone Annotations - error_prone_annotations-2.5.1.jar
412412
* Javassist -- javassist-3.25.0-GA.jar
413413
* Apache Avro

‎pom.xml

+3-3
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ flexible messaging model and an intuitive client API.</description>
154154
<bouncycastle.version>1.69</bouncycastle.version>
155155
<bouncycastle.bcpkix-fips.version>1.0.6</bouncycastle.bcpkix-fips.version>
156156
<bouncycastle.bc-fips.version>1.0.2.3</bouncycastle.bc-fips.version>
157-
<jackson.version>2.13.4.20221013</jackson.version>
157+
<jackson.version>2.15.0</jackson.version>
158158
<reflections.version>0.10.2</reflections.version>
159159
<swagger.version>1.6.2</swagger.version>
160160
<puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
@@ -203,7 +203,7 @@ flexible messaging model and an intuitive client API.</description>
203203
<hbase.version>2.4.15</hbase.version>
204204
<guava.version>31.0.1-jre</guava.version>
205205
<jcip.version>1.0</jcip.version>
206-
<prometheus-jmx.version>0.16.1</prometheus-jmx.version>
206+
<prometheus-jmx.version>0.18.0</prometheus-jmx.version>
207207
<confluent.version>6.2.8</confluent.version>
208208
<aircompressor.version>0.20</aircompressor.version>
209209
<asynchttpclient.version>2.12.1</asynchttpclient.version>
@@ -242,7 +242,7 @@ flexible messaging model and an intuitive client API.</description>
242242
<apache-http-client.version>4.5.13</apache-http-client.version>
243243
<apache-httpcomponents.version>4.4.15</apache-httpcomponents.version>
244244
<jetcd.version>0.5.11</jetcd.version>
245-
<snakeyaml.version>1.32</snakeyaml.version>
245+
<snakeyaml.version>2.0</snakeyaml.version>
246246
<ant.version>1.10.12</ant.version>
247247
<seancfoley.ipaddress.version>5.3.3</seancfoley.ipaddress.version>
248248
<disruptor.version>3.4.3</disruptor.version>

‎pulsar-common/src/main/java/org/apache/pulsar/common/util/FieldParser.java

+5-4
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@
2121
import static com.google.common.base.Preconditions.checkArgument;
2222
import static java.lang.String.format;
2323
import static java.util.Objects.requireNonNull;
24-
import com.fasterxml.jackson.databind.AnnotationIntrospector;
25-
import com.fasterxml.jackson.databind.introspect.JacksonAnnotationIntrospector;
24+
import com.fasterxml.jackson.databind.DeserializationConfig;
25+
import com.fasterxml.jackson.databind.ObjectMapper;
2626
import com.fasterxml.jackson.databind.util.EnumResolver;
2727
import java.lang.reflect.Field;
2828
import java.lang.reflect.Method;
@@ -58,7 +58,8 @@ public final class FieldParser {
5858
private static final Map<String, Method> CONVERTERS = new HashMap<>();
5959
private static final Map<Class<?>, Class<?>> WRAPPER_TYPES = new HashMap<>();
6060

61-
private static final AnnotationIntrospector ANNOTATION_INTROSPECTOR = new JacksonAnnotationIntrospector();
61+
private static final ObjectMapper MAPPER = new ObjectMapper();
62+
private static final DeserializationConfig DESERIALIZATION_CONFIG = MAPPER.getDeserializationConfig();
6263

6364
static {
6465
// Preload converters and wrapperTypes.
@@ -100,7 +101,7 @@ public static <T> T convert(Object from, Class<T> to) {
100101

101102
if (to.isEnum()) {
102103
// Converting string to enum
103-
EnumResolver r = EnumResolver.constructUsingToString((Class<Enum<?>>) to, ANNOTATION_INTROSPECTOR);
104+
EnumResolver r = EnumResolver.constructUsingToString(DESERIALIZATION_CONFIG, (Class<Enum<?>>) to);
104105
T value = (T) r.findEnum((String) from);
105106
if (value == null) {
106107
throw new RuntimeException("Invalid value '" + from + "' for enum " + to);

‎pulsar-sql/presto-distribution/LICENSE

+15-15
Original file line numberDiff line numberDiff line change
@@ -207,19 +207,19 @@ This projects includes binary packages with the following licenses:
207207
The Apache Software License, Version 2.0
208208

209209
* Jackson
210-
- jackson-annotations-2.13.4.jar
211-
- jackson-core-2.13.4.jar
212-
- jackson-databind-2.13.4.2.jar
213-
- jackson-dataformat-smile-2.13.4.jar
214-
- jackson-datatype-guava-2.13.4.jar
215-
- jackson-datatype-jdk8-2.13.4.jar
216-
- jackson-datatype-joda-2.13.4.jar
217-
- jackson-datatype-jsr310-2.13.4.jar
218-
- jackson-dataformat-yaml-2.13.4.jar
219-
- jackson-jaxrs-base-2.13.4.jar
220-
- jackson-jaxrs-json-provider-2.13.4.jar
221-
- jackson-module-jaxb-annotations-2.13.4.jar
222-
- jackson-module-jsonSchema-2.13.4.jar
210+
- jackson-annotations-2.15.0.jar
211+
- jackson-core-2.15.0.jar
212+
- jackson-databind-2.15.0.2.jar
213+
- jackson-dataformat-smile-2.15.0.jar
214+
- jackson-datatype-guava-2.15.0.jar
215+
- jackson-datatype-jdk8-2.15.0.jar
216+
- jackson-datatype-joda-2.15.0.jar
217+
- jackson-datatype-jsr310-2.15.0.jar
218+
- jackson-dataformat-yaml-2.15.0.jar
219+
- jackson-jaxrs-base-2.15.0.jar
220+
- jackson-jaxrs-json-provider-2.15.0.jar
221+
- jackson-module-jaxb-annotations-2.15.0.jar
222+
- jackson-module-jsonSchema-2.15.0.jar
223223
* Guava
224224
- guava-31.0.1-jre.jar
225225
- listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
@@ -401,7 +401,7 @@ The Apache Software License, Version 2.0
401401
* RocksDB JNI
402402
- rocksdbjni-7.9.2.jar
403403
* SnakeYAML
404-
- snakeyaml-1.32.jar
404+
- snakeyaml-2.0.jar
405405
* Bean Validation API
406406
- validation-api-2.0.1.Final.jar
407407
* Objectsize
@@ -456,7 +456,7 @@ The Apache Software License, Version 2.0
456456
* Snappy
457457
- snappy-java-1.1.8.4.jar
458458
* Jackson
459-
- jackson-module-parameter-names-2.13.4.jar
459+
- jackson-module-parameter-names-2.15.0.jar
460460
* Java Assist
461461
- javassist-3.25.0-GA.jar
462462
* Java Native Access

0 commit comments

Comments
 (0)