Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 1.3] Fix dependencies #6036

Merged
merged 4 commits into from
Jan 27, 2023

Conversation

ryanbogan
Copy link
Member

@ryanbogan ryanbogan commented Jan 27, 2023

Signed-off-by: Ryan Bogan rbogan@amazon.com

Description

  • Upgradingjetty-server (which brings in jetty-http) due to GHSA-cj7v-27pg-wf7q which is brought in by hadoop-minicluster.
  • Upgrading kotlin-stdlib which is brought in through hadoop-minicluster. See GHSA-cqj8-47ch-rvvq.
  • Upgrading snakeyaml which is brought in by com.avast.gradle:gradle-docker-compose-plugin. See GHSA-98wm-3w3q-mw94

Backport of #4963

Issues Resolved

[List any issues this PR will resolve]

Check List

  • New functionality includes testing.
    • All tests pass
  • New functionality has been documented.
    • New functionality has javadoc added
  • Commits are signed per the DCO using --signoff
  • Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Ryan Bogan <rbogan@amazon.com>
@github-actions
Copy link
Contributor

Gradle Check (Jenkins) Run Completed with:

@codecov-commenter
Copy link

codecov-commenter commented Jan 27, 2023

Codecov Report

Merging #6036 (69fe60c) into 1.3 (4350ea9) will increase coverage by 0.04%.
The diff coverage is n/a.

❗ Current head 69fe60c differs from pull request most recent head a36eb98. Consider uploading reports for the commit a36eb98 to get more accurate results

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@             Coverage Diff              @@
##                1.3    #6036      +/-   ##
============================================
+ Coverage     77.82%   77.87%   +0.04%     
- Complexity    63394    63398       +4     
============================================
  Files          4454     4454              
  Lines        274944   274944              
  Branches      41166    41166              
============================================
+ Hits         213988   214122     +134     
+ Misses        44033    43901     -132     
+ Partials      16923    16921       -2     
Impacted Files Coverage Δ
...search/indices/recovery/RecoveryTargetHandler.java 0.00% <0.00%> (-100.00%) ⬇️
...ch/index/shard/ShardNotInPrimaryModeException.java 50.00% <0.00%> (-50.00%) ⬇️
...regations/metrics/AbstractHyperLogLogPlusPlus.java 51.72% <0.00%> (-44.83%) ⬇️
...java/org/opensearch/threadpool/ThreadPoolInfo.java 56.25% <0.00%> (-37.50%) ⬇️
...ion/admin/cluster/node/info/PluginsAndModules.java 53.12% <0.00%> (-34.38%) ⬇️
...search/aggregations/metrics/ParsedPercentiles.java 42.10% <0.00%> (-30.53%) ⬇️
...va/org/opensearch/client/sniff/SnifferBuilder.java 72.72% <0.00%> (-27.28%) ⬇️
...pensearch/index/shard/SearchOperationListener.java 75.53% <0.00%> (-23.41%) ⬇️
...ion/termvectors/MultiTermVectorsShardResponse.java 76.92% <0.00%> (-23.08%) ⬇️
...lucene/index/SequentialStoredFieldsLeafReader.java 77.77% <0.00%> (-22.23%) ⬇️
... and 480 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@ryanbogan ryanbogan marked this pull request as ready for review January 27, 2023 03:34
@mch2
Copy link
Member

mch2 commented Jan 27, 2023

related ccc90c4

Signed-off-by: Ryan Bogan <rbogan@amazon.com>
@ryanbogan ryanbogan changed the title Upgrade snake_yaml to fix CVE [Backport 1.3] Fix dependencies Jan 27, 2023
Signed-off-by: Ryan Bogan <rbogan@amazon.com>
@github-actions
Copy link
Contributor

Gradle Check (Jenkins) Run Completed with:

@github-actions
Copy link
Contributor

Gradle Check (Jenkins) Run Completed with:

@ryanbogan ryanbogan merged commit 2ac1c13 into opensearch-project:1.3 Jan 27, 2023
@ryanbogan ryanbogan deleted the snakeyaml_1.3 branch January 27, 2023 05:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants