geyanggang opened a new issue, #10584: URL: https://github.com/apache/gravitino/issues/10584
### What would you like to be improved? `hive-metastore2-libs` ships `jackson-databind:2.6.5` and `hive-metastore3-libs` ships `jackson-databind:2.12.0`, both pulled in transitively via `hive-metastore` → `hive-serde` → `hive-common`. The project-wide Jackson version defined in `libs.versions.toml` is `2.15.2`. These outdated transitive versions should be aligned for consistency and to benefit from upstream bug fixes and improvements. ### How should we improve? Use resolutionStrategy.force in both `build.gradle.kts` to force `jackson-databind`,` jackson-core`, and `jackson-annotations` to the project-wide version `2.15.2`. This is safe because: 1. Jackson 2.x maintains backward compatibility across minor versions. 2. Only basic Jackson APIs (`ObjectMapper`, `ObjectReader`, `ObjectWriter`, `JsonSerializer`, `JsonDeserializer`) are used in `hive-common`, via `StatsSetupConst$ColumnStatsAccurate `and `CodahaleMetrics$JsonFileReporter` (Hive 2) / `JsonFileMetricsReporter` (Hive 3). These APIs are stable across 2.6–2.15. 3. Hive metastore's JSON messaging layer uses Jackson 1.x (`org.codehaus.jackson`), which is unaffected. 4. These classes are loaded via `HiveClientClassLoader` in isolation and are not directly referenced by Gravitino code. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
