AbsaOSS / AbsaOSS/pramen

Remove security vulnerabilities if possible

未关闭
#215 2 条评论 0 个 reaction 已指派 1 人 已被 @yruslan 认领 在 GitHub 查看
DE DS enhancement
主要语言
Scala
星标
31
派生
4
平均合并
1 天 10 分钟
30 天内合并 PR
4

描述

## Background
SonaType has created this dependency security report:
https://sbom.lift.sonatype.com/report/T1-118f0f57da8c6b3097cc-bb6bb3ca7a4e7-1687241554-048abf44d6b64eb2a99d21507e643b0b

Vulnerable libraries include:
- Kafka Client v2.5.1 - this is explicit dependency that we can change
- Snappy Java (1.1.7.3) - this is a transitive dependency. Maybe we can switch to the latest Spark for default builds and it can solve it.

## Feature
Update project dependencies to remove security vulnerabilities while keeping Pramen compatible with Spark 2.4.3+

Make the default build for Spark 3.4.0 or later

## Example
Kafka client can be made spark version dependent if Spark requires certain version of the Kafka client

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。