[HADOOP-18676] Include jettison as direct dependency of hadoop-common

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: common
• Labels: pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed
• Assignee: Andras Katona
• Reporter: Andras Katona
• Created: 23/Mar/23 16:23
• Updated: 27/Jan/24 08:32
• Resolved: 27/Mar/23 08:18

Description

When hadoop common is pulled in outside of hadoop project, the wrong version of jettison is coming as the dependency management of hadoop-project doesn't apply this case.

So it's not enough just to upgrade the version in dependency management. When jettison is coming only as transitive, whoever is pulling in that hadoop library, will still get the wrong jettison.
example:
hadoop-common

org.example:untitled:jar:1.0-SNAPSHOT
\- org.apache.hadoop:hadoop-common:jar:3.4.0-SNAPSHOT:compile
...
   +- com.github.pjfanning:jersey-json:jar:1.20:compile
   |  +- org.codehaus.jettison:jettison:jar:1.1:compile
...

When the module is a library (so it will be used outside of the actual project), the correct dependency must be declared as direct dependency (and optionally excluding from the dependency where it came from originally).

jettison should be added as direct dependency

Issue Links

• relates to: HADOOP-18587 upgrade to jettison 1.5.3 to fix CVE-2022-40150
• links to: GitHub Pull Request #5507
• links to: GitHub Pull Request #5512
• links to: GitHub Pull Request #5513