[HADOOP-18332] Remove rs-api dependency by downgrading jackson to 2.12.7

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0, 3.3.4
• Fix Version/s: 3.4.0, 3.3.4
• Component/s: build
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.4
• Hadoop Flags: Incompatible change
• Release Note: Downgrades Jackson from 2.13.2 to 2.12.7 to fix class conflicts in downstream projects. This version of jackson does contain the fix for CVE-2020-36518.
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 11/Jul/22 11:56
• Updated: 28/Jan/24 00:26
• Resolved: 17/Jul/22 16:05

Description

This jsr311-api jar seems to conflict with newly added rs-api jar dependency - they have many of the same classes (but conflicting copies) - jersey-core 1.19 needs jsr311-api to work properly (and fails if rs-api used instead)

• https://mvnrepository.com/artifact/javax.ws.rs/jsr311-api
• https://mvnrepository.com/artifact/javax.ws.rs/javax.ws.rs-api

Seems we will need to downgrade jackson to 2.12.7 because of jax-rs compatibility issues in jackson 2.13 (see https://github.com/FasterXML/jackson-jaxrs-providers/issues/134)

Issue Links

• is related to: HADOOP-18619 replace jsr311-api dependency with rs-api
• is related to: HADOOP-18305 Release Hadoop 3.3.4: minor update of hadoop-3.3.3
• relates to: HADOOP-18033 Upgrade fasterxml Jackson to 2.13.0
• supercedes: HADOOP-18323 Bump javax.ws.rs-api To Version 3.1.0
• links to: GitHub Pull Request #4547
• links to: GitHub Pull Request #4552
• links to: GitHub Pull Request #4552 (branch-3.3)
• links to: GitHub Pull Request #4569