cassandra-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tatu Saloranta (Jira)" <j...@apache.org>
Subject [jira] [Comment Edited] (CASSANDRA-16854) Exclude Jackson 1.x dependency that leaks via old hadoop-core dependency
Date Fri, 13 Aug 2021 20:18:00 GMT

    [ https://issues.apache.org/jira/browse/CASSANDRA-16854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17398901#comment-17398901
] 

Tatu Saloranta edited comment on CASSANDRA-16854 at 8/13/21, 8:17 PM:
----------------------------------------------------------------------

Simple patch would be:
{code:java}
diff --git a/build.xml b/build.xml
index 41dffa12bc..c84e04c24d 100644
--- a/build.xml
+++ b/build.xml
@@ -539,10 +539,12 @@
             <exclusion groupId="org.eclipse.jdt" artifactId="core"/>
             <exclusion groupId="ant" artifactId="ant"/>
             <exclusion groupId="junit" artifactId="junit"/>
+            <exclusion groupId="org.codehaus.jackson" artifactId="jackson-mapper-asl"/>
             <exclusion groupId="org.slf4j" artifactId="slf4j-api"/>
           </dependency>
           <dependency groupId="org.apache.hadoop" artifactId="hadoop-minicluster" version="1.0.3"
scope="provided">
             <exclusion groupId="asm" artifactId="asm"/> <!-- this is the outdated
version 3.1 -->
+            <exclusion groupId="org.codehaus.jackson" artifactId="jackson-mapper-asl"/>
             <exclusion groupId="org.slf4j" artifactId="slf4j-api"/>
           </dependency>
           <dependency groupId="net.java.dev.jna" artifactId="jna" version="5.6.0"/>
{code}
(added as attachment as well)

 


was (Author: cowtowncoder):
Simple patch would be:
{code:java}
diff --git a/build.xml b/build.xml
index 41dffa12bc..c84e04c24d 100644
--- a/build.xml
+++ b/build.xml
@@ -539,10 +539,12 @@
             <exclusion groupId="org.eclipse.jdt" artifactId="core"/>
             <exclusion groupId="ant" artifactId="ant"/>
             <exclusion groupId="junit" artifactId="junit"/>
+            <exclusion groupId="org.codehaus.jackson" artifactId="jackson-mapper-asl"/>
             <exclusion groupId="org.slf4j" artifactId="slf4j-api"/>
           </dependency>
           <dependency groupId="org.apache.hadoop" artifactId="hadoop-minicluster" version="1.0.3"
scope="provided">
             <exclusion groupId="asm" artifactId="asm"/> <!-- this is the outdated
version 3.1 -->
+            <exclusion groupId="org.codehaus.jackson" artifactId="jackson-mapper-asl"/>
             <exclusion groupId="org.slf4j" artifactId="slf4j-api"/>
           </dependency>
           <dependency groupId="net.java.dev.jna" artifactId="jna" version="5.6.0"/>
{code}

> Exclude Jackson 1.x dependency that leaks via old hadoop-core dependency
> ------------------------------------------------------------------------
>
>                 Key: CASSANDRA-16854
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-16854
>             Project: Cassandra
>          Issue Type: Improvement
>          Components: Dependencies
>            Reporter: Tatu Saloranta
>            Assignee: Tatu Saloranta
>            Priority: Normal
>         Attachments: CASSANDRA-16854.patch
>
>
> build.xml has a dependency for an old hadoop-core version (1.0.3). This is likely needed
for some Hadoop compatibility code under `src/java/org/apache/cassandra/hadoop`. Since 1.0.3
was released in 2012, its dependencies are very old; in particular it depends on "jackson-mapper-asl"
1.0.1 (from 2009!).
> An earlier issue CASSANDRA-15867 referenced this dependency as well (but did not actually
remove it for some reason, which marked as resolved).
> Although `hadoop-core` dependency is marked as "provided" (and should then not be included
in distributed version) it seems best to avoid downloading it during build to "build/lib/jars".
This can be done by adding 2 exclusions for "hadoop-core" and "hadoop-minicluster" dependencies
in build.xml.
> I will provide a patch.
> I also tried updating "hadoop-core" to the latest public version (1.2.1), which would
have upgraded jackson-mapper-asl to 1.8.8, but that breaks the build due to some other version
incompatibility (asm, possibly). If anyone wants to tackle that issue it could be a good follow-up
task; "hadoop-core" itself has been moved to "hadoop-client" it seems (and there's "hadoop-commons"
too... confusing).
>  



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org


Mime
View raw message