fix(security): update ranger commons & dependencies for security vulns

datahub-project · Nov 30, 2022 · 7068661 · 7068661
1 parent 329ecb8
commit 7068661
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 3 deletions.
diff --git a/build.gradle b/build.gradle
@@ -79,6 +79,7 @@ project.ext.externalDependency = [
     'hadoopClient': 'org.apache.hadoop:hadoop-client:3.2.1',
     'hadoopCommon':'org.apache.hadoop:hadoop-common:2.7.2',
     'hadoopMapreduceClient':'org.apache.hadoop:hadoop-mapreduce-client-core:2.7.2',
+    'hadoopCommon3':'org.apache.hadoop:hadoop-common:3.3.4',
     'hibernateCore': 'org.hibernate:hibernate-core:5.2.16.Final',
     'httpClient': 'org.apache.httpcomponents:httpclient:4.5.9',
     'httpAsyncClient': 'org.apache.httpcomponents:httpasyncclient:4.1.5',
@@ -135,6 +136,7 @@ project.ext.externalDependency = [
     'playPac4j': 'org.pac4j:play-pac4j_2.12:8.0.2',
     'postgresql': 'org.postgresql:postgresql:42.3.3',
     'protobuf': 'com.google.protobuf:protobuf-java:3.19.3',
+    'rangerCommons': 'org.apache.ranger:ranger-plugins-common:2.3.0',
     'reflections': 'org.reflections:reflections:0.9.9',
     'resilience4j': 'io.github.resilience4j:resilience4j-retry:1.7.1',
     'rythmEngine': 'org.rythmengine:rythm-engine:1.3.0',

diff --git a/datahub-ranger-plugin/build.gradle b/datahub-ranger-plugin/build.gradle
@@ -24,8 +24,11 @@ compileJava {
 }
 
 dependencies {
-    implementation 'org.apache.ranger:ranger-plugins-common:2.3.0'
-    compile 'org.apache.logging.log4j:log4j-1.2-api:2.17.1'
+    implementation(externalDependency.rangerCommons) {
+        exclude group: "org.apache.htrace", module: "htrace-core4"
+    }
+    implementation externalDependency.hadoopCommon3
+    implementation 'org.apache.logging.log4j:log4j-1.2-api:2.17.1'
 
     testCompile externalDependency.testng
 }

diff --git a/metadata-service/auth-ranger-impl/build.gradle b/metadata-service/auth-ranger-impl/build.gradle
@@ -8,7 +8,11 @@ compileJava {
 dependencies {
     compile project(path: ':metadata-service:auth-api')
 
-    implementation 'org.apache.ranger:ranger-plugins-common:2.3.0'
+    implementation(externalDependency.rangerCommons) {
+        exclude group: "org.apache.htrace", module: "htrace-core4"
+    }
+    implementation externalDependency.hadoopCommon3
+
     implementation 'org.apache.logging.log4j:log4j-1.2-api:2.17.1'
     implementation 'rome:rome:1.0'
     runtimeOnly externalDependency.jna