[HADOOP-18658] snakeyaml dependency: upgrade to v2.0

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.4.0, 3.3.6
• Labels: pull-request-available
• Hadoop Flags: Reviewed
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 09/Mar/23 11:09
• Updated: 19/Jul/23 10:54
• Resolved: 13/Mar/23 04:38

Description

• https://github.com/advisories/GHSA-mjmj-j48q-9wg2
• I don't think this needs to go in v3.3.5 - since this CVE affects part of snakeyaml that hadoop doesn't use

Issue Links

• is duplicated by: HADOOP-18719 upgrade snakeyaml to 2.0 (fixes CVE-2022-1471)
• is related to: HADOOP-18472 Upgrade to snakeyaml 1.33
• relates to: YARN-11535 Remove jackson-dataformat-yaml dependency
• links to: GitHub Pull Request #5467
• links to: GitHub Pull Request #5595