Skip to content

Commit

Permalink
[FLINK-29235][Build System] Bump snakeyaml from 1.27 to 1.31
Browse files Browse the repository at this point in the history
Bumps [snakeyaml](https://bitbucket.org/snakeyaml/snakeyaml) from 1.27 to 1.31.
- [Commits](https://bitbucket.org/snakeyaml/snakeyaml/branches/compare/snakeyaml-1.31..snakeyaml-1.27)

---
updated-dependencies:
- dependency-name: org.yaml:snakeyaml
  dependency-type: direct:production
...

* Update the minimum required version of SnakeYAML in POM files to prevent new vulnerable versions to be pulled in

Signed-off-by: dependabot[bot] <[email protected]>
  • Loading branch information
dependabot[bot] authored and MartijnVisser committed Nov 1, 2022
1 parent bcfb8d8 commit dab3eae
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
2 changes: 1 addition & 1 deletion flink-kubernetes/src/main/resources/META-INF/NOTICE
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ This project bundles the following dependencies under the Apache Software Licens
- io.fabric8:kubernetes-model-scheduling:5.12.3
- io.fabric8:kubernetes-model-storageclass:5.12.3
- io.fabric8:zjsonpatch:0.3.0
- org.yaml:snakeyaml:1.27
- org.yaml:snakeyaml:1.31

This project bundles the following dependencies under the BSD License.
See bundled license files for details.
Expand Down
6 changes: 3 additions & 3 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -865,7 +865,7 @@ under the License.
<!-- Bumped for security purposes and making it work with Jackson dependencies (2.10.1) -->
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>1.27</version>
<version>1.31</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
Expand Down Expand Up @@ -1699,12 +1699,12 @@ under the License.
<rules>
<bannedDependencies>
<excludes>
<exclude>org.yaml:snakeyaml:(,1.26]</exclude>
<exclude>org.yaml:snakeyaml:(,1.30]</exclude>
</excludes>
<includes>
<!-- Snakeyaml is pulled in by many modules without using it in production,
so there's no benefit in us investing time into bumping these. -->
<include>org.yaml:snakeyaml:(,1.26]:*:test</include>
<include>org.yaml:snakeyaml:(,1.30]:*:test</include>
</includes>
<message>Older snakeyaml versions are not allowed due to security vulnerabilities.</message>
</bannedDependencies>
Expand Down

0 comments on commit dab3eae

Please sign in to comment.