address the security vulnerabilities reported by snyk.io

radanalyticsio / spark-operator

Operator for managing the Spark clusters on Kubernetes and OpenShift.

Apache License 2.0

156 stars 61 forks source link

Open jkremser opened 6 years ago

jkremser commented 6 years ago

the commons-collection can be ignored because it is 'provided' dep for the kubernetes model (doesn't end up on the class path)
guava: https://github.com/ronmamo/reflections/issues/243
jackson libs: https://github.com/fabric8io/kubernetes-model/issues/338

meanwhile I can hotfix by exclusions in the parent pom

jkremser commented 6 years ago

jkremser commented 5 years ago

also quay.io reports some vulnerabilities. These can be fixed by yum update in the dockerfile