Exlude transitive dependencies of hadoop (close #234)

snowplow · Dec 14, 2021 · b8e5ed3 · b8e5ed3
1 parent d9374d3
commit b8e5ed3
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/build.sbt b/build.sbt
@@ -35,8 +35,10 @@ lazy val root = project.in(file("."))
       Dependencies.Libraries.apacheCommons,
       Dependencies.Libraries.jackson,
       Dependencies.Libraries.jacksonCbor,
+      Dependencies.Libraries.thrift,
       Dependencies.Libraries.sentry,
       Dependencies.Libraries.collections,
+      Dependencies.Libraries.jaxbApi,
       // Scala
       Dependencies.Libraries.decline,
       Dependencies.Libraries.circe,

diff --git a/project/Dependencies.scala b/project/Dependencies.scala
@@ -33,8 +33,10 @@ object Dependencies {
     val jacksonCbor      = "2.9.10"
     val sentry           = "1.7.30"
     val collections      = "3.2.2" // Address vulnerability
+    val jaxbApi          = "2.3.1"
     // Thrift (test only)
     val collectorPayload = "0.0.0"
+    val thrift           = "0.15.0" // Address vulnerabilities
     // Scala
     val decline         = "2.0.0"
     val circe           = "0.13.0"
@@ -54,6 +56,7 @@ object Dependencies {
     val kinesisConnector = "com.amazonaws"                    %  "amazon-kinesis-connectors" % V.kinesisConnector
     val jacksonCbor      = "com.fasterxml.jackson.dataformat" % "jackson-dataformat-cbor"    % V.jacksonCbor
     val jackson          = "com.fasterxml.jackson.core"       % "jackson-databind"           % V.jackson
+    val thrift           = "org.apache.thrift"                % "libthrift"                  % V.thrift
     val hadoop           = ("org.apache.hadoop"               %  "hadoop-common"             % V.hadoop)
       .exclude("org.slf4j", "slf4j-log4j12")
       .exclude("commons-beanutils", "commons-beanutils")
@@ -62,6 +65,19 @@ object Dependencies {
       .exclude("commons-logging", "commons-logging")
       .exclude("org.apache.htrace", "htrace-core")
       .exclude("junit", "junit")
+      .exclude("org.apache.zookeeper", "zookeeper")
+      .exclude("org.apache.hadoop", "hadoop-auth")
+      .exclude("org.apache.curator", "curator-client")
+      .exclude("log4j", "log4j")
+      .exclude("com.google.code.gson", "gson")
+      .exclude("org.apache.avro", "avro")
+      .exclude("org.codehaus.jackson", "jackson-mapper-asl")
+      .exclude("com.sun.jersey", "jersey-json")
+      .exclude("org.mortbay.jetty", "jetty-sslengine")
+      .exclude("org.mortbay.jetty", "jetty-util")
+      .exclude("org.mortbay.jetty", "jetty")
+    val collections      = "commons-collections"              % "commons-collections"                % V.collections
+    val jaxbApi          = "javax.xml.bind"                   % "jaxb-api"                           % V.jaxbApi
     val elephantbird     = ("com.twitter.elephantbird"        %  "elephant-bird-core"                % V.elephantbird)
       .exclude("com.hadoop.gplcompression", "hadoop-lzo")
     val hadoopLZO        = "com.hadoop.gplcompression"        %  "hadoop-lzo"                        % V.hadoopLZO