Hi Cassandra developers, Today I learned that Guava 18 has "severe" vulnerability [1,2]. As per code freezing, Cassandra 3.11 still accepts security related PRs. Will Cassandra team accept a pull request to upgrade Guava in 3.11 [3], if I create one?
[1]: https://search.maven.org/artifact/com.google.guava/guava/18.0/bundle [2]: https://ossindex.sonatype.org/vuln/24585a7f-eb6b-4d8d-a2a9-a6f16cc7c1d0 [3]: https://issues.apache.org/jira/browse/CASSANDRA-15453 On Mon, Dec 16, 2019 at 12:45 PM Tomo Suzuki <suzt...@google.com> wrote: > > Russell, > > That's great to hear. Then I'll wait for Cassandra 4 release for now. > In the meantime, I found an outdated dependency in Cassandra. Ticketed > [1]. > > [1]: CASSANDRA-15455 Upgrade com.carrotsearch:hppc dependency > > > On Mon, Dec 16, 2019 at 12:08 AM Russell Spitzer > <russell.spit...@gmail.com> wrote: > > > > The hadoop formats should be compatible with any Cassandra version > > regardless of which Cassandra-all you include since they communicate with > > the driver under the hood and not Cassandra internal libraries. This means > > you should feel free to use Cassandra 4 in your integration without fear of > > losing backwards compatibility. In fact it should be able to speak to > > Cassandra 2.x as well. > > > > On Sun, Dec 15, 2019, 10:24 PM Tomo Suzuki <suzt...@google.com.invalid> > > wrote: > > > > > Hi Russell, > > > > > > Yes, Apache Beam uses hadoop format for Cassandra IO [1]. That test > > > (HadoopFormatIOCassandraTest) failed [2] when I tried to upgrade Guava > > > version. Added this information to the ticket. > > > > > > [1]: https://beam.apache.org/documentation/io/built-in/hadoop/ > > > [2]: > > > https://github.com/GoogleCloudPlatform/cloud-opensource-java/issues/1028#issuecomment-557680928 > > > > > > On Sun, Dec 15, 2019 at 10:36 PM Russell Spitzer > > > <russell.spit...@gmail.com> wrote: > > > > > > > > Why does the beam integration rely on Cassandra all, does it use the > > > hadoop > > > > formats? > > > > > > > > On Sun, Dec 15, 2019, 9:07 PM Tomo Suzuki <suzt...@google.com.invalid> > > > > wrote: > > > > > > > > > Hi Cassandra developers, > > > > > > > > > > I want to backport the Guava version upgrade (CASSANDRA-15248) into > > > > > 3.11 branch, so that cassandra-all:3.11.X works with higher version of > > > > > Guava. > > > > > I just created a ticket > > > > > https://issues.apache.org/jira/browse/CASSANDRA-15453 explaining > > > > > background. > > > > > > > > > > Before committing anything, I'd like to hear any opinion on the > > > > > backporting. What do you think? > > > > > > > > > > Regards, > > > > > Tomo > > > > > > > > > > --------------------------------------------------------------------- > > > > > To unsubscribe, e-mail: dev-unsubscr...@cassandra.apache.org > > > > > For additional commands, e-mail: dev-h...@cassandra.apache.org > > > > > > > > > > > > > > > > > > > > > > -- > > > Regards, > > > Tomo > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: dev-unsubscr...@cassandra.apache.org > > > For additional commands, e-mail: dev-h...@cassandra.apache.org > > > > > > > > > > -- > Regards, > Tomo -- Regards, Tomo --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@cassandra.apache.org For additional commands, e-mail: dev-h...@cassandra.apache.org
