Skip to content

Commit

Permalink
Use alluxio-core instead of shaded deps to get rid of CVEs
Browse files Browse the repository at this point in the history
  • Loading branch information
@denodo-research-labs
denodo-research-labs committed Dec 13, 2024
1 parent e8cca76 commit 839a27d
Show file tree
Hide file tree
Showing 15 changed files with 220 additions and 74 deletions.
196 changes: 188 additions & 8 deletions pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@
<dep.docker-java.version>3.3.0</dep.docker-java.version>
<dep.jayway.version>2.9.0</dep.jayway.version>
<dep.ratis.version>2.2.0</dep.ratis.version>
<dep.errorprone.version>2.18.0</dep.errorprone.version>
<dep.errorprone.version>2.28.0</dep.errorprone.version>
<dep.guava.version>32.1.0-jre</dep.guava.version>
<dep.jackson.version>2.15.4</dep.jackson.version>
<dep.j2objc.version>2.8</dep.j2objc.version>
Expand All @@ -84,6 +84,9 @@
<dep.protobuf-java.version>3.25.5</dep.protobuf-java.version>
<dep.netty.version>4.1.115.Final</dep.netty.version>
<dep.snakeyaml.version>2.0</dep.snakeyaml.version>
<dep.gson.version>2.11.0</dep.gson.version>
<dep.commons.lang3.version>3.14.0</dep.commons.lang3.version>
<dep.guice.version>5.1.0</dep.guice.version>

<!--
America/Bahia_Banderas has:
Expand Down Expand Up @@ -546,6 +549,26 @@
</exclusions>
</dependency>

<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-netty</artifactId>
<version>${grpc.version}</version>
<exclusions>
<exclusion>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.errorprone</groupId>
<artifactId>error_prone_annotations</artifactId>
</exclusion>
<exclusion>
<groupId>org.codehaus.mojo</groupId>
<artifactId>animal-sniffer-annotations</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-netty-shaded</artifactId>
Expand All @@ -566,10 +589,32 @@
</exclusions>
</dependency>

<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-services</artifactId>
<version>${grpc.version}</version>
<exclusions>
<exclusion>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.errorprone</groupId>
<artifactId>error_prone_annotations</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-core</artifactId>
<version>${grpc.version}</version>
<exclusions>
<exclusion>
<groupId>org.codehaus.mojo</groupId>
<artifactId>animal-sniffer-annotations</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand Down Expand Up @@ -1459,25 +1504,137 @@

<dependency>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-shaded-client</artifactId>
<artifactId>alluxio-core-client-hdfs</artifactId>
<version>${dep.alluxio.version}</version>
<exclusions>
<exclusion>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-core-transport</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-client</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
</exclusion>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-core-client-fs</artifactId>
<version>${dep.alluxio.version}</version>
<exclusions>
<exclusion>
<groupId>com.github.stateless4j</groupId>
<artifactId>stateless4j</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
</exclusion>
<exclusion>
<groupId>org.rocksdb</groupId>
<artifactId>rocksdbjni</artifactId>
</exclusion>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<artifactId>slf4j-api</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-core-common</artifactId>
<version>${dep.alluxio.version}</version>
<exclusions>
<exclusion>
<groupId>com.rabbitmq</groupId>
<artifactId>amqp-client</artifactId>
</exclusion>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>commons-cli</groupId>
<artifactId>commons-cli</artifactId>
</exclusion>
<exclusion>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
<exclusion>
<groupId>io.etcd</groupId>
<artifactId>jetcd-core</artifactId>
</exclusion>
<exclusion>
<groupId>io.netty</groupId>
<artifactId>netty-tcnative-boringssl-static</artifactId>
</exclusion>
<exclusion>
<groupId>io.prometheus</groupId>
<artifactId>prometheus-metrics-exporter-servlet-jakarta</artifactId>
</exclusion>
<exclusion>
<groupId>io.swagger</groupId>
<artifactId>swagger-annotations</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.curator</groupId>
<artifactId>curator-client</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.curator</groupId>
<artifactId>curator-framework</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j-impl</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.zookeeper</groupId>
<artifactId>zookeeper</artifactId>
</exclusion>
<exclusion>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
</exclusion>
<exclusion>
<groupId>org.reflections</groupId>
<artifactId>reflections</artifactId>
</exclusion>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down Expand Up @@ -1634,6 +1791,10 @@
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-smile</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.inject.extensions</groupId>
<artifactId>guice-multibindings</artifactId>
</exclusion>
<exclusion>
<groupId>it.unimi.dsi</groupId>
<artifactId>fastutil</artifactId>
Expand Down Expand Up @@ -1684,13 +1845,13 @@
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.5.5</version>
<version>4.5.13</version>
</dependency>

<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpcore</artifactId>
<version>4.4.9</version>
<version>4.4.14</version>
</dependency>

<dependency>
Expand Down Expand Up @@ -1974,6 +2135,10 @@
<groupId>com.google.code.findbugs</groupId>
<artifactId>annotations</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.inject.extensions</groupId>
<artifactId>guice-multibindings</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down Expand Up @@ -2201,6 +2366,12 @@
<version>5.0.1</version>
</dependency>

<dependency>
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>
<version>${dep.gson.version}</version>
</dependency>

<dependency>
<groupId>com.google.errorprone</groupId>
<artifactId>error_prone_annotations</artifactId>
Expand Down Expand Up @@ -2231,6 +2402,12 @@
<version>${dep.commons.compress.version}</version>
</dependency>

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>${dep.commons.lang3.version}</version>
</dependency>

<dependency>
<groupId>com.datastax.cassandra</groupId>
<artifactId>cassandra-driver-core</artifactId>
Expand Down Expand Up @@ -2323,7 +2500,6 @@
<requireUpperBoundDeps>
<excludes combine.children="append">
<!-- TODO: fix this in Airlift resolver -->
<exclude>org.alluxio:alluxio-shaded-client</exclude>
<exclude>org.codehaus.plexus:plexus-utils</exclude>
<exclude>com.google.guava:guava</exclude>
<exclude>com.fasterxml.jackson.core:jackson-annotations</exclude>
Expand All @@ -2340,11 +2516,15 @@
<artifactId>duplicate-finder-maven-plugin</artifactId>
<configuration>
<ignoredClassPatterns combine.children="append">
<ignoredClassPattern>com.github.benmanes.caffeine.*</ignoredClassPattern>
<!-- Duplicate class is being brought in by commons-io & log4j-api -->
<ignoredClassPattern>META-INF.versions.9.module-info</ignoredClassPattern>
<!-- Duplicate class is being brought in by several netty dependencies-->
<ignoredClassPattern>META-INF.versions.11.module-info</ignoredClassPattern>
</ignoredClassPatterns>
<ignoredResourcePatterns combine.children="append">
<ignoredResourcePattern>git.properties</ignoredResourcePattern>
</ignoredResourcePatterns>
</configuration>
</plugin>

Expand Down
1 change: 0 additions & 1 deletion presto-accumulo/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,6 @@
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.4</version>
</dependency>

<dependency>
Expand Down
24 changes: 0 additions & 24 deletions presto-bigquery/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,6 @@
<scope>import</scope>
</dependency>

<dependency>
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>
<version>2.8.9</version>
</dependency>

<dependency>
<groupId>org.threeten</groupId>
<artifactId>threetenbp</artifactId>
Expand All @@ -45,24 +39,6 @@
<version>0.28.0</version>
</dependency>

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.14.0</version>
</dependency>

<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpcore</artifactId>
<version>4.4.14</version>
</dependency>

<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.5.13</version>
</dependency>

<dependency>
<groupId>com.google.api-client</groupId>
<artifactId>google-api-client</artifactId>
Expand Down
30 changes: 29 additions & 1 deletion presto-cache/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,17 @@

<dependency>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-shaded-client</artifactId>
<artifactId>alluxio-core-client-hdfs</artifactId>
</dependency>

<dependency>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-core-client-fs</artifactId>
</dependency>

<dependency>
<groupId>org.alluxio</groupId>
<artifactId>alluxio-core-common</artifactId>
</dependency>

<!-- Presto SPI -->
Expand Down Expand Up @@ -139,4 +149,22 @@
<scope>test</scope>
</dependency>
</dependencies>

<build>
<pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<configuration>
<ignoredUsedUndeclaredDependencies>
<!-- Ignore because it's picked up as false-positive from alluxio's dependencies -->
<dependency>io.dropwizard.metrics:metrics-core</dependency>
</ignoredUsedUndeclaredDependencies>
</configuration>
</plugin>
</plugins>
</pluginManagement>
</build>

</project>
Loading

0 comments on commit 839a27d

Please sign in to comment.