Skip to content

Commit

Permalink
HADOOP-18197. Upgrade protobuf to 3.20.1
Browse files Browse the repository at this point in the history
This patch bumps up the protobuf version so that Hadoop
is not a vulnerable to CVE-2021-22569.

I'm not renaming the module hadoop-shaded-protobuf_3_7
because that significantly complicates imports/upgrading.
That said, I don't see why the version number needed to be
included there. We will have to live with that.

This also fixes up the parent POM references in the child modules
as IntelliJ requires a full path.

Testing: needs to go through hadoop built with the updated jar and
with its own protobuf version marker updated.
Verified hadoop compiles on a macbook m1.
  • Loading branch information
steveloughran committed Jun 8, 2022
1 parent 8c7f31a commit 0c73512
Show file tree
Hide file tree
Showing 4 changed files with 6 additions and 6 deletions.
2 changes: 1 addition & 1 deletion LICENSE-binary
Original file line number Diff line number Diff line change
Expand Up @@ -217,7 +217,7 @@ See licenses-binary/ for text of these licenses.

BSD 3-Clause
------------
com.google.protobuf:protobuf-java:3.7.1
com.google.protobuf:protobuf-java:3.20.1


MIT License
Expand Down
2 changes: 1 addition & 1 deletion hadoop-shaded-guava/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
<artifactId>hadoop-thirdparty</artifactId>
<groupId>org.apache.hadoop.thirdparty</groupId>
<version>1.2.0-SNAPSHOT</version>
<relativePath>..</relativePath>
<relativePath>../pom.xml</relativePath>
</parent>
<modelVersion>4.0.0</modelVersion>
<artifactId>hadoop-shaded-guava</artifactId>
Expand Down
6 changes: 3 additions & 3 deletions hadoop-shaded-protobuf_3_7/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,11 @@
<artifactId>hadoop-thirdparty</artifactId>
<groupId>org.apache.hadoop.thirdparty</groupId>
<version>1.2.0-SNAPSHOT</version>
<relativePath>..</relativePath>
<relativePath>../pom.xml</relativePath>
</parent>
<modelVersion>4.0.0</modelVersion>
<artifactId>hadoop-shaded-protobuf_3_7</artifactId>
<name>Apache Hadoop shaded Protobuf 3.7</name>
<name>Apache Hadoop shaded Protobuf</name>
<packaging>jar</packaging>

<properties>
Expand All @@ -38,7 +38,7 @@
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
<version>${protobuf_3_7.version}</version>
<version>${protobuf_3.version}</version>
</dependency>
</dependencies>

Expand Down
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@
<!--thirdparty dependency versions-->
<shaded.prefix>org.apache.hadoop.thirdparty</shaded.prefix>
<protobuf.shade.prefix>${shaded.prefix}.protobuf</protobuf.shade.prefix>
<protobuf_3_7.version>3.7.1</protobuf_3_7.version>
<protobuf_3.version>3.20.1</protobuf_3.version>
<guava.version>30.1.1-jre</guava.version>

<!-- maven plugin versions -->
Expand Down

0 comments on commit 0c73512

Please sign in to comment.