[HADOOP-15261] Upgrade commons-io from 2.4 to 2.5

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-alpha3
• Fix Version/s: 3.1.0, 2.10.2
• Component/s: minikdc
• Hadoop Flags: Reviewed
• Assignee: PandaMonkey
• Reporter: PandaMonkey
• Created: 26/Feb/18 07:19
• Updated: 24/May/22 05:49
• Resolved: 02/Mar/18 23:48

Description

Hi, after analyzing hadoop-common-project\hadoop-minikdc\pom.xml, we found that Hadoop depends on org.apache.kerby:kerb-simplekdc 1.0.1, which transitivity introduced commons-io:2.5.
At the same time, hadoop directly depends on a older version of commons-io:2.4. By further look into the source code, these two versions of commons-io have many different features. The dependency conflict problem brings high risks of "NotClassDefFoundError:" or "NoSuchMethodError" issues at runtime. Please notice this problem. Maybe upgrading commons-io from 2.4 to 2.5 is a good choice. Hope this report can help you. Thanks!

Issue Links

• breaks: HADOOP-15305 Replace FileUtils.writeStringToFile(File, String) with (File, String, Charset) to fix deprecation warnings
• is depended upon by: HADOOP-9991 Fix up Hadoop POMs, roll up JARs to latest versions
• is related to: SPARK-31130 Use the same version of `commons-io` in SBT
• links to: GitHub Pull Request #347