Skip to content

NIFI-12276 Addressed Dependency Check Findings for support branch#7989

Closed
exceptionfactory wants to merge 1 commit intoapache:support/nifi-1.xfrom
exceptionfactory:NIFI-12276-1
Closed

NIFI-12276 Addressed Dependency Check Findings for support branch#7989
exceptionfactory wants to merge 1 commit intoapache:support/nifi-1.xfrom
exceptionfactory:NIFI-12276-1

Conversation

@exceptionfactory
Copy link
Contributor

Summary

NIFI-12276 Addresses a number of OWASP Dependency Check findings. This pull request targets the version 1 support branch, applying the same basic set of changes already applied to the main branch. Dependency updates and changes include the following:

  • Upgraded Janino Commons Compiler from 3.1.9 to 3.1.10
  • Upgraded Azure SDK BOM from 1.2.16 to 1.2.17
  • Upgraded GCP SDK BOM from 26.17.0 to 26.25.0
  • Upgraded AWS SDK from 1.12.550 to 1.12.573
  • Upgraded Hazelcast from 5.3.2 to 5.3.5
  • Upgraded Jersey from 2.39.12 to 2.41
  • Upgraded Camel Salesforce from 3.14.5 to 3.14.9
  • Unified ZooKeeper versioning on 3.9.1
  • Applied Groovy 2.4.21 to Hive 3 and Iceberg components
  • Applied gRPC version 1.59.0 to Asana components
  • Applied Jettison 1.5.4 to Atlas and Hive 3 components
  • Managed JUnit 4 version to 4.13.2 for MockWebServer
  • Excluded HBase libraries from Hive 3 following Iceberg approach
  • Excluded Htrace from HBase components
  • Upgraded OWASP Dependency Check from 8.4.0 to 8.4.2
  • Removed non-applicable dependency check suppressions
  • Added dependency check suppressions for non-applicable findings

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

Pull Request Tracking

  • Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
  • Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

  • Pull Request based on current revision of the main branch
  • Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

  • Build completed using mvn clean install -P contrib-check
    • JDK 21

Licensing

  • New dependencies are compatible with the Apache License 2.0 according to the License Policy
  • New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

  • Documentation formatting appears as expected in rendered files

- Upgraded Janino Commons Compiler from 3.1.9 to 3.1.10
- Upgraded Azure SDK BOM from 1.2.16 to 1.2.17
- Upgraded GCP SDK BOM from 26.17.0 to 26.25.0
- Upgraded AWS SDK from 1.12.550 to 1.12.573
- Upgraded Hazelcast from 5.3.2 to 5.3.5
- Upgraded Jersey from 2.39.12 to 2.41
- Upgraded Camel Salesforce from 3.14.5 to 3.14.9
- Unified ZooKeeper versioning on 3.9.1
- Applied Groovy 2.4.21 to Hive 3 and Iceberg components
- Applied gRPC version 1.59.0 to Asana components
- Applied Jettison 1.5.4 to Atlas and Hive 3 components
- Managed JUnit 4 version to 4.13.2 for MockWebServer
- Excluded HBase libraries from Hive 3 following Iceberg approach
- Excluded Htrace from HBase components
- Upgraded OWASP Dependency Check from 8.4.0 to 8.4.2
- Removed non-applicable dependency check suppressions
- Added dependency check suppressions for non-applicable findings
asfgit pushed a commit that referenced this pull request Nov 7, 2023
- Upgraded Janino Commons Compiler from 3.1.9 to 3.1.10
- Upgraded Azure SDK BOM from 1.2.16 to 1.2.17
- Upgraded GCP SDK BOM from 26.17.0 to 26.25.0
- Upgraded AWS SDK from 1.12.550 to 1.12.573
- Upgraded Hazelcast from 5.3.2 to 5.3.5
- Upgraded Jersey from 2.39.12 to 2.41
- Upgraded Camel Salesforce from 3.14.5 to 3.14.9
- Unified ZooKeeper versioning on 3.9.1
- Applied Groovy 2.4.21 to Hive 3 and Iceberg components
- Applied gRPC version 1.59.0 to Asana components
- Applied Jettison 1.5.4 to Atlas and Hive 3 components
- Managed JUnit 4 version to 4.13.2 for MockWebServer
- Excluded HBase libraries from Hive 3 following Iceberg approach
- Excluded Htrace from HBase components
- Upgraded OWASP Dependency Check from 8.4.0 to 8.4.2
- Removed non-applicable dependency check suppressions
- Added dependency check suppressions for non-applicable findings

Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>

This closes #7989.
@pvillard31 pvillard31 closed this Nov 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants