[SYSTEMDS-2510] Your project apache/systemml is using buggy third-party libraries [WARNING]

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: SystemDS 2.0
• Assignee: Matthias Boehm
• Reporter: Kaifeng Huang
• Created: 15/Feb/19 09:51
• Updated: 25/Jul/20 18:31
• Resolved: 25/Jul/20 18:31

Description

Hi, there!

We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions.

We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information.

1. commons-collections commons-collections
version: 3.2.1

Jira issues:
Inconsistent Javadoc comment and code in addIgnoreNull(Collection<T>; T) in org.apache.commons.collections.CollectionUtils
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-400?filter=allopenissues
ListUtils.subtract is very slow
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-406?filter=allopenissues
ListOrderedSet.removeAll() is slow
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-407?filter=allopenissues
ListOrderedSet.addAll() is very slow
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-409?filter=allopenissues
Performance problem in DualHashBidiMap
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-413?filter=allopenissues
AbstractLinkedList.removeAll() is very slow
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-415?filter=allopenissues
AbstractLinkedList.retainAll() is very slow
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-417?filter=allopenissues
Surprising exception by CompositeSet in a situation where CompositeCollection works fine
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-424?filter=allopenissues
performance problem in ListOrderedMap.remove()
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-425?filter=allopenissues
performance problem in ListOrderedSet.retainAll()
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-426?filter=allopenissues
performance problem in SetUniqueList.retainAll()
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-427?filter=allopenissues
SetUniqueList may become inconsistent
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-444?filter=allopenissues
findBugs Warnings: several classes in package functors may expose their internal representation
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-453?filter=allopenissues
findBugs Warning: Flat3Map - 3 iterators which are "both an Iterator and a Map.Entry"
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-454?filter=allopenissues
wasted work in AbstractMapBag.containsAll()
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-472?filter=allopenissues
ListOrderedSet can have duplicates
affectsVersions:3.2.1;4.0
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-524?filter=allopenissues
ExtendedProperties causes AccessControlException when framework is called from a script
affectsVersions:3.2.1
https://issues.apache.org/jira/projects/COLLECTIONS/issues/COLLECTIONS-538?filter=allopenissues

Sincerely~
FDU Software Engineering Lab
Feb 15th,2019