java-driver icon indicating copy to clipboard operation
java-driver copied to clipboard

Bump jnr-posix version to 3.1.8

Open yaronkaikov opened this issue 1 year ago • 8 comments
trafficstars

fix CWE-416 https://security.snyk.io/vuln/SNYK-JAVA-COMGITHUBJNR-1570422

yaronkaikov avatar Feb 28 '24 15:02 yaronkaikov

Did you pay attention to the comment above that change?

<!-- Note:  When upgrading either jnr-ffi or jnr-posix, ensure that the versions are compatible.
             JNR has broken compatibility between minor versions in the past. -->

mykaul avatar Feb 28 '24 15:02 mykaul

How come we did not get https://github.com/apache/cassandra-java-driver/commit/55e6e40afcd7df2be931285b323379f9ea8c6c82 from upstream?

mykaul avatar Feb 28 '24 15:02 mykaul

Did you pay attention to the comment above that change?

<!-- Note:  When upgrading either jnr-ffi or jnr-posix, ensure that the versions are compatible.
             JNR has broken compatibility between minor versions in the past. -->

Yep, I just need to update the PR description

yaronkaikov avatar Feb 28 '24 15:02 yaronkaikov

How come we did not get apache@55e6e40 from upstream?

We use a specific version, i am not sure we will get any other unless we change it

yaronkaikov avatar Mar 03 '24 18:03 yaronkaikov

@yaronkaikov - what happened to this one?

mykaul avatar Apr 25 '24 11:04 mykaul

@yaronkaikov - what happened to this one?

completely forgot about it, @avelanarius ping

yaronkaikov avatar Apr 25 '24 11:04 yaronkaikov

@avelanarius @Bouncheck Can you please review/merge/comment on this?

yaronkaikov avatar Apr 30 '24 05:04 yaronkaikov

/cc @roydahan

yaronkaikov avatar Apr 30 '24 05:04 yaronkaikov

How come we did not get apache@55e6e40 from upstream?

This commit is from 4.x branch.

avelanarius avatar May 06 '24 11:05 avelanarius

@yaronkaikov how do i ensure compatibility if I want to upgrade jnr libraries again?

Bouncheck avatar Sep 23 '24 16:09 Bouncheck

@yaronkaikov how do i ensure compatibility if I want to upgrade jnr libraries again?

I am not sure, do we have some unit-tests for this?

yaronkaikov avatar Sep 25 '24 05:09 yaronkaikov