Repository navigation
Document gremlin-shaded/databricks-jdbc vendored Jackson/lz4 CVEs as accepted exceptions - #3203
Open
terryozaki-wq wants to merge 1 commit into
Open
terryozaki-wq wants to merge 1 commit into
terryozaki-wq wants to merge 1 commit into
Conversation
… as accepted exceptions Both jars shade a private copy of jackson-databind/jackson-core (gremlin-shaded, via tinkerpop.version) or lz4-java (databricks-jdbc) into their own bytecode. These copies are invisible to this pom.xml's jackson2.version/jackson3.version/lz4.version dependencyManagement pins, so scanners keep flagging CVEs against them that a version bump here can't fix. Documents what was checked (every stable TinkerPop release through 3.8.2, and databricks-jdbc 3.4.4) and why no fix is currently available, so the next scanner hit doesn't re-start the investigation from scratch. No code change; this is a documentation-only accepted-exception record, written after the same investigation on IL4-dev found both repos pin the identical tinkerpop.version (3.7.7) and databricks.jdbc.version (2.8.4), so the same vendored versions and conclusions apply here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gremlin-shaded(viatinkerpop.version, currently3.7.7) anddatabricks-jdbc(currently2.8.4) each shade a private copy ofjackson-databind/jackson-coreorlz4-javainto their own bytecode.jackson2.version/jackson3.version/lz4.versiondependencyManagementpins — a version bump here has no effect on them — but scanners (Dependabot/Inspector-style) still flag the embedded classes against this repo.docker/DEPENDENCY-EXCEPTIONS.mdrecording what was checked and why no fix is currently available, so the next scanner hit doesn't restart the investigation from scratch:3.8.2bundles the same vulnerable Jackson2.18.9(3.8.0actually regresses to2.15.2); only the pre-release4.0.0-beta.3relocates Jackson, which isn't warranted as a dependency for this alone.lz4-javais fixed in the3.xline (confirmed by downloading and inspecting3.4.4.jardirectly), but no fix exists in the current2.xline; this repo's own directly-declaredlz4-javais already on the fixed version, so only the copy vendored inside the driver jar is affected.No code change — this is a documentation-only accepted-exception record. Confirmed
devand IL4-dev pin the identicaltinkerpop.version(3.7.7) anddatabricks.jdbc.version(2.8.4), so the same investigation and conclusions, originally done on IL4-dev, transfer directly.Test plan
🤖 Generated with Claude Code