Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Depcheck issues #30

Merged
merged 4 commits into from
May 7, 2020
Merged

Depcheck issues #30

merged 4 commits into from
May 7, 2020

Conversation

rliberal
Copy link
Contributor

@rliberal rliberal commented May 6, 2020

We are fixing this Vulnerability:

scala-reflect-2.12.8.jar (pkg:maven/org.scala-lang/scala-reflect@2.12.8, cpe:2.3:a:scala-lang:scala:2.12.8:::::::*) : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

@rliberal rliberal requested a review from hvillalb May 6, 2020 17:41
@@ -1 +1 @@
version=2.5.0-SNAPSHOT
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gradle.properties is updated by the one who deploy the release. Please undo this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

build.gradle Outdated
testImplementation('org.apache.kafka:kafka_2.12:2.3.1') {
exclude group: 'org.scala-lang', module: 'scala-reflect'
}
testImplementation group: 'org.scala-lang', name: 'scala-reflect', version: '2.12.11'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

latest release is 2.13.2 . Why 2.12.11 ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because new version needs another version of kafka.
The other way is to change kafka, or get a compilation error.

Copy link
Contributor Author

@rliberal rliberal May 6, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got this compilation error with version 2.13.2: /src/test/java/com/opendxl/databus/util/Topic.java:65: error: cannot access Serializable
new TopicCommand.ZookeeperTopicService(zkUtils).createTopic(opts);
^
class file for scala.Serializable not found

Copy link
Contributor Author

@rliberal rliberal May 6, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So last compatible version is 2.12.11 released on march 2020.

https://mvnrepository.com/artifact/org.scala-lang/scala-reflect

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed and finally will be use 2.12.11

}
implementation ('org.apache.kafka:kafka-streams:2.3.1') {
exclude group: 'org.scala-lang', module: 'scala-reflect'
}
implementation 'org.apache.avro:avro:1.9.0'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should you add a entry for scala-reflect in implementation ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it's needed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

build.gradle Outdated
kafkaInMemory ('org.apache.kafka:kafka_2.12:2.3.1') {
exclude group: 'org.scala-lang', module: 'scala-reflect'
}
kafkaInMemory group: 'org.scala-lang', name: 'scala-reflect', version: '2.12.11'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

check version

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed and finally will be use 2.12.11

@rliberal rliberal merged commit 24cd8d0 into master May 7, 2020
@hvillalb hvillalb deleted the depcheck-issues branch May 7, 2020 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants