fix CVE-2025-0851 #3477
fix CVE-2025-0851 #3477
Conversation
jngz-es
requested review from
b4sjoo,
dhrubo-os,
mingshl,
model-collapse,
rbhavna,
ylwu-amzn,
zane-neo,
Zhangxunmt,
austintlee,
HenryL27 and
xinyual
as code owners
jngz-es
had a problem deploying
to
ml-commons-cicd-env
GitHub Actions
Failure
jngz-es
had a problem deploying
to
ml-commons-cicd-env
GitHub Actions
Failure
Signed-off-by: Jing Zhang <jngz@amazon.com>
jngz-es
temporarily deployed
to
ml-commons-cicd-env
GitHub Actions
Inactive
jngz-es
temporarily deployed
to
ml-commons-cicd-env
GitHub Actions
Inactive
plugin/build.gradle
Outdated
| @@ -417,6 +417,8 @@ configurations.all { | |||
| resolutionStrategy.force "org.apache.logging.log4j:log4j-api:2.24.2" | |||
| resolutionStrategy.force "org.apache.logging.log4j:log4j-core:2.24.2" | |||
| resolutionStrategy.force "jakarta.json:jakarta.json-api:2.1.3" | |||
| resolutionStrategy.force "com.google.code.gson:gson:2.11.0" | |||
There was a problem hiding this comment.
other modules are using 2.10.1. Should we upgrade all of them? Having two different versions in the same project doesn't make enough sense to me.
Also in this file, we have gson in line 84 with 2.10.1, may be we can remove this?
Otherwise we will keep adding versions this way, which is not a clean code IMO.
There was a problem hiding this comment.
Yeah, agree. Let me upgrade all to 2.11.0.
There was a problem hiding this comment.
I was suggesting something like this: https://github.com/opensearch-project/ml-commons/pull/3478/files
Signed-off-by: Jing Zhang <jngz@amazon.com>
jngz-es
had a problem deploying
to
ml-commons-cicd-env
GitHub Actions
Failure
jngz-es
had a problem deploying
to
ml-commons-cicd-env
GitHub Actions
Failure
jngz-es
temporarily deployed
to
ml-commons-cicd-env
GitHub Actions
Inactive
jngz-es
had a problem deploying
to
ml-commons-cicd-env
GitHub Actions
Failure
jngz-es
temporarily deployed
to
ml-commons-cicd-env
GitHub Actions
Inactive
jngz-es
temporarily deployed
to
ml-commons-cicd-env
GitHub Actions
Inactive
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #3477 +/- ##
============================================
- Coverage 80.24% 80.22% -0.03%
+ Complexity 6904 6902 -2
============================================
Files 610 610
Lines 30081 30076 -5
Branches 3370 3368 -2
============================================
- Hits 24139 24127 -12
- Misses 4491 4497 +6
- Partials 1451 1452 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
Closing this pr in flavor of #3478. |
Description
[Describe what this change achieves]
Related Issues
Resolves #[Issue number to be closed when this PR is merged]
Check List
--signoff.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.