[NIFI-9782] Exclude H2 from Druid Components

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.16.0
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 09/Mar/22 17:17
• Updated: 09/Mar/22 20:27
• Resolved: 09/Mar/22 20:27

Description

The nifi-druid-bundle includes several modules that have a transitive dependency on com.h2database:h2 version 1 through io.druid:tranquility-core_2.11, which depends on com.metamx:scala_util.  The current dependency definition for tranquility-core_2.11 already excludes a number of unnecessary transitive dependencies.  The H2 transitive dependency should also be excluded to avoid theoretical security vulnerabilities in version 1.

Issue Links

• links to: GitHub Pull Request #5854