[HBASE-28188] Narrow the netty3 dependency scope

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: dependencies, hadoop3, security
• Assignee: Unassigned
• Reporter: Duo Zhang
• Created: 06/Nov/23 03:47
• Updated: 06/Nov/23 08:43

Description

Netty 3 has a bunch of CVEs and will never be fixed.

In HBase, we poll in netty 3 dependency through hadoop, and till hadop 3.3.6, the dependency is still there.

The only place for hadoop 3.1.x where we depend on netty 3 is in MR's ShuffleHandler.

https://issues.apache.org/jira/browse/HADOOP-15327

So I think at least wecould narrow the dependency scope for netty 3 to test scope, as it is only used in tests we start a MiniMRCluster.

Issue Links

• is related to: HADOOP-15327 Upgrade MR ShuffleHandler to use Netty4