-
Notifications
You must be signed in to change notification settings - Fork 9.1k
HADOOP-15760. Upgrade commons-collections to commons-collections4 #7006
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
- Excluded commons-collections and completely banned it - Upgraded to commons-collections and made changes as per the new package
Hi @steveloughran I have upgraded to commons-collections4 and not just included it as per JIRA description. If this is fine for others, we may need to update jira description as well to keep in sync. Else I can fall back to actual ask which was "Include Apache Commons Collections4". But again commons-collections:commons-collections:3.2.2 has a possible CVE: sonatype-2024-3350, also see https://issues.apache.org/jira/browse/COLLECTIONS-701. So we may not want to keep in for new releases! |
too big a change for 3.4.1, but I'm looking at a 3.4.2 release with dependency updates and a move to java11+ only (!)... (ideally few feature changes, just major bug fixes) |
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
/build |
afraid to force a build you need to do a git branch merge onto trunk. |
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
Hi @steveloughran the UT failures are gone now. Please let me know if any changes needed in this PR. |
Gentle ping @steveloughran |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1. lets get into trunk and see if anyone complains.
Can you do a PR for branch-3.4 -we can merge it if yetus is happy
Thank you @steveloughran for merging into trunk.
Sure let me put up a PR for same. |
) (#7097) This moves Hadoop to Apache commons-collections4. Apache commons-collections has been removed and is completely banned from the source code. Contributed by Nihal Jain
Description of PR
How was this patch tested?
Ran
mvn clean install -DskipTests
and ensure code build. Will see how jenkins reacts with UTs!For code changes:
LICENSE
,LICENSE-binary
,NOTICE-binary
files?