Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FLINK-36197 bump curator-test, derby and postgres #878

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

r-sidd
Copy link
Contributor

@r-sidd r-sidd commented Sep 2, 2024

Bump curator-test version to latest (5.7.0) to remediate the vulnerabilities in the dependant packages.

Package details:
https://mvnrepository.com/artifact/org.apache.curator/curator-test/5.7.0

Bump postgresql version to 42.5.6 to remediate a direct finding.
Finding details:
CVE-2024-1597

Package details:
https://mvnrepository.com/artifact/org.postgresql/postgresql/42.5.6

Bump derby version to latest (10.17.1.0) to remediate direct finding.
Finding details:
CVE-2022-46337

Package details:
https://mvnrepository.com/artifact/org.apache.derby/derby/10.17.1.0

Does this pull request potentially affect one of the following parts:

  • Dependencies (does it add or upgrade a dependency): yes

Documentation

  • Does this pull request introduce a new feature? no

@gyfora
Copy link
Contributor

gyfora commented Sep 3, 2024

@r-sidd it would be great to bundle test-dependency upgrades together in 1-2 PRs if you are going to do any further

@r-sidd
Copy link
Contributor Author

r-sidd commented Sep 3, 2024

@r-sidd it would be great to bundle test-dependency upgrades together in 1-2 PRs if you are going to do any further

Sure, let me see if any other test dependency can be upgraded and will try bundling it in this PR.

@r-sidd r-sidd force-pushed the FLINK-36197-bump-curator-test branch from 483b3bd to 5e45aaa Compare September 11, 2024 18:41
@r-sidd r-sidd changed the title FLINK-36197 bump curator-test FLINK-36197 bump curator-test, derby and postgres Sep 11, 2024
@r-sidd
Copy link
Contributor Author

r-sidd commented Sep 11, 2024

@r-sidd it would be great to bundle test-dependency upgrades together in 1-2 PRs if you are going to do any further

@gyfora sorry couldn't find time to address these. Bumping few vulnerable packages in this PR, will try to bundle few more test-dependency in next PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants