Skip to content

Upgrade jackson, json-smart, and netty dependency versions#1993

Draft
sidhdirenge wants to merge 1 commit into
developfrom
jetski/fix-vulns-jackson-netty
Draft

Upgrade jackson, json-smart, and netty dependency versions#1993
sidhdirenge wants to merge 1 commit into
developfrom
jetski/fix-vulns-jackson-netty

Conversation

@sidhdirenge

Copy link
Copy Markdown

No description provided.

@sidhdirenge sidhdirenge added the build Trigger unit test build label Jun 18, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates subproject commits for azure and kafka-plugins, upgrades the parquet-avro dependency in format-parquet/pom.xml, and adds json-smart to the parent pom.xml dependency management. Feedback recommends managing the parquet-avro and json-smart versions via properties in the parent POM rather than hardcoding them, and points out that the Jackson and Netty dependency versions should also be updated in the parent POM to prevent potential version mismatches.

Comment thread pom.xml
Comment on lines +136 to +140
<dependency>
<groupId>net.minidev</groupId>
<artifactId>json-smart</artifactId>
<version>2.4.11</version>
</dependency>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The pull request title indicates an upgrade for Jackson and Netty dependency versions, but the corresponding properties <jackson.databind.version> and <netty.version> in the parent pom.xml have not been updated.

If these properties are not updated in the parent POM, modules inheriting from it (such as format-parquet or other core modules) will continue to use the older versions, potentially leading to version mismatches or classpath issues with the upgraded submodules (azure, kafka-plugins).

Additionally, please consider defining a property for the json-smart version (e.g., ${json-smart.version}) in the <properties> section of the parent POM to keep it consistent with other dependency versions.

Suggested change
<dependency>
<groupId>net.minidev</groupId>
<artifactId>json-smart</artifactId>
<version>2.4.11</version>
</dependency>
<dependency>
<groupId>net.minidev</groupId>
<artifactId>json-smart</artifactId>
<version>${json-smart.version}</version>
</dependency>

Comment thread format-parquet/pom.xml Outdated
<groupId>org.apache.parquet</groupId>
<artifactId>parquet-avro</artifactId>
<version>1.12.0</version>
<version>1.12.3</version>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Instead of hardcoding the version 1.12.3 directly in the child POM, it is recommended to manage this version in the parent pom.xml (either via <dependencyManagement> or by defining a <parquet.version> property in the parent POM). This ensures consistency across all modules and aligns with how other dependencies in this project are managed.

Suggested change
<version>1.12.3</version>
<version>${parquet.version}</version>

@sidhdirenge sidhdirenge force-pushed the jetski/fix-vulns-jackson-netty branch from 4d6eaef to 7f1969c Compare June 18, 2026 09:02
…, CVE-2021-27568, CVE-2015-2156

- Root pom.xml: Add json-smart override to 2.4.11
- format-parquet/pom.xml: Bump parquet-avro to 1.12.3
- kafka-plugins: Bump jackson.version to 2.13.4.2
- azure: Override netty version to 3.9.9.Final in adls-plugins
@sidhdirenge sidhdirenge force-pushed the jetski/fix-vulns-jackson-netty branch from 7f1969c to ebf541b Compare June 18, 2026 10:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Trigger unit test build

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant