[FLINK-15540] flink-shaded-hadoop-2-uber bundles wrong dependency versions

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: shaded-9.0
• Fix Version/s: shaded-10.0
• Component/s: BuildSystem / Shaded
• Labels: pull-request-available
• Assignee: Chesnay Schepler
• Reporter: Chesnay Schepler
• Created: 09/Jan/20 12:53
• Updated: 09/Apr/20 01:08
• Resolved: 16/Jan/20 09:13

Description

For legacy reasons flink-shaded contains 2 modules for hadoop:
flink-shaded-hadoop-2, defining the core dependencies and versions via dependency management, and flink-shaded-hadoop-2-uber for creating a fat jar.

In this kind of setup the dependency management in flink-shaded-hadoop-2 is ignored by the -uber module; dependency management entries only apply if they are located in a parent module or within the module itself.

As a result flink-shaded-hadoop-2-uber is bundling the wrong versions of several dependencies; among others we bundle commons-collections 3.2.1, instead of 3.2.2, which has a security issue.

Issue Links

• links to: GitHub Pull Request #80