search

pravega / schema-registry

Pravega Schema Registry repository
Apache License 2.0
15 stars 23 forks source link

Issue 242: Update Third Party Library Versions #243

Closed shshashwat closed 2 years ago

shshashwat commented 2 years ago

Signed-off-by: Shashwat Sharma shashwat_sharma@dell.com

Change log description
Few libraries version identified with possible vulnerabilities, this needs to be updated

Purpose of the change
Fixes #242

What the code does
Update the library version with possible vulnerabilities

How to verify it
All test cases should pass, Schema-Registry samples should work with Pravega Samples

kotlasaicharanreddy commented 2 years ago

@shshashwat could you please provide kind of tests performed on this ?

shshashwat commented 2 years ago

building and running Schema Registry samples with latest Pravega master is working fine in local

shshashwat commented 2 years ago

ObjectMapper.Configure is deprecated and as per the JavaDoc new way is to use JsonMapper.builder().configure(...). Ref:- The Javadoc

shshashwat commented 2 years ago

Can you give the CVE number for the avro version upgrade and check if version 1.10.0 also works for you. Thanks.

@crazyzhou The changes made here was as per the issue-ticket created by Security scan. The suggested version in the ticket is 1.11.0 and hence it's changed here. If there is some backward compatibility related issue you're facing the way I faced here, that should be manageable.