Update lucene-analyzers-common and lucene-queryparser to 8.10.0

Resolves 3 Medium cves.
prestodb · Dec 16, 2024 · 3d874b1 · 3d874b1
1 parent 17ac4c3
commit 3d874b1
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 7 deletions.
diff --git a/pom.xml b/pom.xml
@@ -58,6 +58,7 @@
         <dep.joda.version>2.12.7</dep.joda.version>
         <dep.tempto.version>1.53</dep.tempto.version>
         <dep.testng.version>7.5</dep.testng.version>
+        <dep.lucene.version>8.10.0</dep.lucene.version>
         <dep.assertj-core.version>3.8.0</dep.assertj-core.version>
         <dep.logback.version>1.2.13</dep.logback.version>
         <dep.parquet.version>1.13.1</dep.parquet.version>
@@ -2038,13 +2039,13 @@
             <dependency>
                 <groupId>org.apache.lucene</groupId>
                 <artifactId>lucene-analyzers-common</artifactId>
-                <version>7.2.1</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>org.apache.lucene</groupId>
-                        <artifactId>lucene-core</artifactId>
-                    </exclusion>
-                </exclusions>
+                <version>${dep.lucene.version}</version>
+            </dependency>
+
+            <dependency>
+                <groupId>org.apache.lucene</groupId>
+                <artifactId>lucene-queryparser</artifactId>
+                <version>${dep.lucene.version}</version>
             </dependency>
 
             <dependency>
@@ -2344,6 +2345,8 @@
                             <ignoredClassPattern>META-INF.versions.9.module-info</ignoredClassPattern>
                             <!-- Duplicate class is being brought in by several netty dependencies-->
                             <ignoredClassPattern>META-INF.versions.11.module-info</ignoredClassPattern>
+                            <!-- Ignore duplicate classes related to lucene-core and ranger-apache -->
+                            <ignoredClassPattern>META-INF.versions.9.org.apache.lucene.*</ignoredClassPattern>
                         </ignoredClassPatterns>
                     </configuration>
                 </plugin>

diff --git a/presto-pinot-toolkit/pom.xml b/presto-pinot-toolkit/pom.xml
@@ -22,6 +22,10 @@
             <groupId>org.apache.pinot</groupId>
             <artifactId>presto-pinot-driver</artifactId>
             <exclusions>
+                <exclusion>
+                    <groupId>org.apache.lucene</groupId>
+                    <artifactId>lucene-core</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>commons-io</groupId>
                     <artifactId>commons-io</artifactId>