Upgraded third-party dependencies to the latest versions and fixed CVE vulnerabilities #34409

JoshuaChen · 2025-01-20T09:38:28Z

Upgraded third-party dependencies to the latest versions and fixed CVE vulnerabilities

Before committing this PR, I'm sure that I have checked the following options:

My code follows the code of conduct of this project.
I have self-reviewed the commit code.
I have (or in comment I request) added corresponding labels for the pull request.
I have passed maven check locally : ./mvnw clean install -B -T1C -Dmaven.javadoc.skip -Dmaven.jacoco.skip -e.
I have made corresponding changes to the documentation.
I have added corresponding unit tests for my changes.
I have updated the Release Notes of the current development version. For more details, see Update Release Note

…E vulnerabilities.

linghengqian

I noticed a bunch of suspicious issues. However, there are no separate issues for the related topics.

linghengqian · 2025-01-20T09:59:38Z

db-protocol/core/pom.xml

+        <dependency>
+            <groupId>org.hamcrest</groupId>
+            <artifactId>hamcrest</artifactId>
+            <scope>test</scope>
+        </dependency>


Why is this necessary? hamcrest is imported globally in the top-level POM.

I see that the current PR adds hamcrest in more than one place, what is the point of doing this?

Although hamcrest was configured in the main pom.xml, the submodule still couldn't find the package when running the test locally.
I found a global duplicate configuration (without scope) before my change in the main pom.xml

I think hamcrest still needs to be defined in the top-level POM, which is cumbersome.

linghengqian · 2025-01-20T10:01:37Z

...pache/shardingsphere/encrypt/checker/sql/insert/EncryptInsertSelectSupportedCheckerTest.java

@@ -38,7 +40,7 @@ class EncryptInsertSelectSupportedCheckerTest {
    @Test
    void assertIsCheck() {
        InsertStatementContext sqlStatementContext = mock(InsertStatementContext.class, RETURNS_DEEP_STUBS);
-        when(sqlStatementContext.getSqlStatement().getInsertSelect().isPresent()).thenReturn(true);
+        when(sqlStatementContext.getSqlStatement().getInsertSelect()).thenReturn(Optional.of(mock(SubquerySegment.class)));


Why does updating some third-party dependencies cause a large number of unit tests to change? Where is the original issue?

The new version of mock will prompt that the thenReturn type is wrong, and Optional.of(mock(SubquerySegment.class)) is required to return

This involves a problem. The new version of mockito does not support JDK8, so it makes no sense to do so.

linghengqian · 2025-01-20T10:02:52Z

pom.xml

+        <commons-compress.version>1.27.1</commons-compress.version>
+        <commons-configuration2.version>2.11.0</commons-configuration2.version>
+        <commons-text.version>1.13.0</commons-text.version>
+        <caffeine.version>3.2.0</caffeine.version>


Isn't the last version of caffeine that supports running on JDK 8 2.9.3? Why is this change necessary?

commons-compress/commons-configuration2/commons-text needs to be specified because the version number conflicts with hadoop-common

This brings up a new topic, why do you need to try to update hadoop? Only hiveserver2 jdbc driver requires hadoop, and hiveserver2 jdbc driver does not support hadoop 3.4.0 at all.

linghengqian · 2025-01-20T10:04:08Z

pom.xml

-        <narayana.version>5.12.7.Final</narayana.version>
-        <jboss-transaction-spi.version>7.6.1.Final</jboss-transaction-spi.version>
-        <jboss-logging.version>3.2.1.Final</jboss-logging.version>
+        <narayana.version>5.13.1.Final</narayana.version>


Isn't the last version of narayana supporting Jakarta EE 8 5.12.7.Final? Why is this change needed?

Upgrade to the last version that supports Java 8

This is not a jdk8 issue, this is an issue related to #27976. You cannot just update the Jakarta EE version without changing the java package.

linghengqian · 2025-01-20T10:04:59Z

pom.xml

+        <jboss-transaction-spi.version>8.0.0.Final</jboss-transaction-spi.version>
+        <jboss-logging.version>3.6.1.Final</jboss-logging.version>


Why do you need to change the version of narayana to be inconsistent with jboss? Actually only narayana needs jboss.

linghengqian · 2025-01-20T10:08:37Z

pom.xml

        <hive.version>4.0.1</hive.version>
        <hive-server2-jdbc-driver-thin.version>1.6.0</hive-server2-jdbc-driver-thin.version>
-        <hadoop.version>3.3.6</hadoop.version>
-        <presto.version>0.288.1</presto.version>
+        <hadoop.version>3.4.1</hadoop.version>


I don't think you can get around HIVE-28191: Upgrade Hadoop Version to 3.4.1 hive#5500 and update hadoop version. hadoop 3.4.0 completely broke hiveserver2 jdbc driver.

linghengqian · 2025-01-20T10:09:01Z

pom.xml

        <jaybird.version>5.0.6.java8</jaybird.version>

-        <hikari-cp.version>4.0.3</hikari-cp.version>
+        <hikari-cp.version>6.2.1</hikari-cp.version>


The new version of hikaricp has dropped support for JDK8.

linghengqian · 2025-01-20T10:09:17Z

pom.xml

        <hamcrest.version>3.0</hamcrest.version>
-        <mockito.version>4.11.0</mockito.version>
+        <mockito.version>5.15.2</mockito.version>


The new version of mockito has dropped support for JDK8.

linghengqian · 2025-01-20T10:12:28Z

pom.xml

-        <jetcd.version>0.7.7</jetcd.version>
-        <vertx.version>4.5.1</vertx.version>
+        <curator.version>5.7.1</curator.version>
+        <zookeeper.version>3.9.3</zookeeper.version>


Warning, an unopened issue has revealed that zookeeper 3.9.3 has changed binary compatibility compared to 3.9.2, which further breaks nativeTest of shardingsphere under GraalVM Native Image. Can you open an issue on the shardingsphere side for zookeeper and tag me to track it?

linghengqian · 2025-01-20T10:13:12Z

pom.xml

@@ -914,14 +909,17 @@
    <reporting>
        <plugins>
            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>


Why do you need to add groupId manually? These are Maven's syntax sugar.

linghengqian · 2025-01-20T10:27:58Z

.mvn/wrapper/maven-wrapper.properties

@@ -14,6 +14,6 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.9.9


Where did this come from? I don't see this version at https://github.com/apache/maven-wrapper/releases .

JoshuaChen added 3 commits January 20, 2025 17:35

Upgraded third-party dependencies to the latest versions and fixed CV…

cd7a50a

…E vulnerabilities.

Fix spotless failure

5126e47

Lower the dependency version to support Java 11

c560490

linghengqian reviewed Jan 20, 2025

View reviewed changes

JoshuaChen marked this pull request as draft January 20, 2025 10:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgraded third-party dependencies to the latest versions and fixed CVE vulnerabilities #34409

Upgraded third-party dependencies to the latest versions and fixed CVE vulnerabilities #34409

JoshuaChen commented Jan 20, 2025

linghengqian left a comment

linghengqian Jan 20, 2025

JoshuaChen Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

JoshuaChen Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

JoshuaChen Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

JoshuaChen Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025 •

edited

Loading

linghengqian Jan 20, 2025

linghengqian Jan 20, 2025

		<jboss-transaction-spi.version>8.0.0.Final</jboss-transaction-spi.version>
		<jboss-logging.version>3.6.1.Final</jboss-logging.version>

Upgraded third-party dependencies to the latest versions and fixed CVE vulnerabilities #34409

Are you sure you want to change the base?

Upgraded third-party dependencies to the latest versions and fixed CVE vulnerabilities #34409

Conversation

JoshuaChen commented Jan 20, 2025

linghengqian left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

linghengqian Jan 20, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

linghengqian Jan 20, 2025 •

edited

Loading