MLE-29880 and MLE-29897 Update dependencies to address security vulnerabilities#260
Conversation
There was a problem hiding this comment.
Pull request overview
Updates dependency versions in the Gradle build (and aligns third-party notices) to address reported security vulnerabilities in the Kafka MarkLogic connector project.
Changes:
- Bumped Kafka dependency version (
kafkaVersion) from 4.1.1 to 4.3.0. - Bumped
jackson-dataformat-csvfrom 2.20.x to 2.21.3 inbuild.gradle. - Updated
NOTICE.txtto listjackson-dataformat-csvas 2.21.3.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| NOTICE.txt | Updates the documented third-party dependency version for jackson-dataformat-csv to 2.21.3. |
| build.gradle | Updates Kafka version to 4.3.0 and jackson-dataformat-csv to 2.21.3. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| marklogic-data-hub 6.2.1 (Apache-2.0) | ||
| ml-gradle 6.1.0 (Apache-2.0) | ||
| jackson-dataformat-csv 2.20.2 (Apache-2.0) | ||
| jackson-dataformat-csv 2.21.3 (Apache-2.0) |
There was a problem hiding this comment.
I wouldn't update this file, it's all going to get changed when it's generated via Black Duck.
| For the full text of the Apache-2.0 license, see Apache License 2.0 (Apache-2.0) | ||
|
|
||
| jackson-dataformat-csv 2.20.2 (Apache-2.0) | ||
| jackson-dataformat-csv 2.21.3 (Apache-2.0) |
| } | ||
|
|
||
| implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.20.0" | ||
| implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.21.3" |
There was a problem hiding this comment.
One thing I try to do with Jackson is ensure everyone's on the same version of it. That may be more difficult here because the connector depends on DH, but it's worth considering a top-level constraint on Jackson to ensure any dependency in this package is on 2.21.3.
| marklogic-data-hub 6.2.1 (Apache-2.0) | ||
| ml-gradle 6.1.0 (Apache-2.0) | ||
| jackson-dataformat-csv 2.20.2 (Apache-2.0) | ||
| jackson-dataformat-csv 2.21.3 (Apache-2.0) |
There was a problem hiding this comment.
I wouldn't update this file, it's all going to get changed when it's generated via Black Duck.
This pull request updates the version of the
jackson-dataformat-csvdependency listed in theNOTICE.txtfile to reflect the use of version 2.21.3 instead of 2.20.2.Dependency version update:
jackson-dataformat-csvfrom version 2.20.2 to 2.21.3 in theNOTICE.txtfile to ensure accurate documentation of third-party dependencies. [1] [2]