Uploaded image for project: 'Cassandra'
  1. Cassandra
  2. CASSANDRA-16854

Exclude Jackson 1.x dependency that leaks via old hadoop-core dependency

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Normal
    • Resolution: Fixed
    • 3.11.12, 4.0.2, 4.1
    • Dependencies
    • None

    Description

      build.xml has a dependency for an old hadoop-core version (1.0.3). This is likely needed for some Hadoop compatibility code under `src/java/org/apache/cassandra/hadoop`. Since 1.0.3 was released in 2012, its dependencies are very old; in particular it depends on "jackson-mapper-asl" 1.0.1 (from 2009!).
      An earlier issue CASSANDRA-15867 referenced this dependency as well (but did not actually remove it for some reason, which marked as resolved).

      Although `hadoop-core` dependency is marked as "provided" (and should then not be included in distributed version) it seems best to avoid downloading it during build to "build/lib/jars". This can be done by adding 2 exclusions for "hadoop-core" and "hadoop-minicluster" dependencies in build.xml.
      I will provide a patch.

      I also tried updating "hadoop-core" to the latest public version (1.2.1), which would have upgraded jackson-mapper-asl to 1.8.8, but that breaks the build due to some other version incompatibility (asm, possibly). If anyone wants to tackle that issue it could be a good follow-up task; "hadoop-core" itself has been moved to "hadoop-client" it seems (and there's "hadoop-commons" too... confusing).

       

      Attachments

        1. CASSANDRA-16854.patch
          1.0 kB
          Tatu Saloranta

        Activity

          People

            tatu-at-datastax Tatu Saloranta
            cowtowncoder Tatu Saloranta
            Tatu Saloranta
            Michael Semb Wever
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: