[HBASE-28250] Bump jruby to 9.4.8.0 to fix snakeyaml CVE

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.7.0, 3.0.0-beta-2
• Component/s: jruby, security, shell
• Labels: pull-request-available
• Hadoop Flags: Incompatible change, Reviewed

Release Note

This change brings in JRuby 9.4.x which targets Ruby 3.1 compatibility instead of Ruby 2.6 which 9.3.x were having!

Please ensure to replace all "import" statements with "java_import" in your ruby scripts.

Also you could try features like colorize and auto complete via hbase shell arguments with the new JRuby. These are disabled by default!

• Assignee: Nihal Jain
• Reporter: Nihal Jain
• Created: 07/Dec/23 09:43
• Updated: 07/Nov/24 12:21
• Resolved: 16/Aug/24 05:25

Description

As a follow up of HBASE-28249, we want to bump to latest 9.4.x line here. 

This release line drops critical snakeyaml CVE (org.yaml : snakeyaml : 1.33 having CVE-2022-1471) from our classpath with following change along with several other bugs/fixes: 

• The Psych YAML library is updated to 5.1.0. This version switches the JRuby extension to SnakeYAML Engine, avoiding CVEs against the original SnakeYAML and updating YAML compatibility to specification version 1.2. #6365, #7570, #7626

NOTE: JRuby 9.4.x targets Ruby 3.1 compatibility instead of Ruby 2.6 which 9.3.x were having!

Issue Links

• is a clone of: HBASE-28249 Bump jruby to 9.3.13.0 and related joni and jcodings to 2.2.1 and 1.0.58 respectively
• is cloned by: HBASE-28968 Bump jruby to 9.4.9.0 to fix rexml CVE
• is related to: HBASE-27921 Bump up jruby to 9.4.2.0 and related joni and jcodings to 2.1.48 and 1.0.58 respectively
• is related to: HBASE-28864 NoMethodError undefined method assignment_expression?
• links to: GitHub Pull Request #6127
• links to: GitHub Pull Request #6145
• links to: GitHub Pull Request #6146