Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: remove log4j libraries #39

Merged
merged 4 commits into from
Nov 30, 2023
Merged

Conversation

Tingweiftw
Copy link
Contributor

@Tingweiftw Tingweiftw commented Nov 30, 2023

Context

  • Zeppelin 0.10.1 is the latest update, which was updated on Feb 28 2022.
  • For the OAuth to work, buji-pac4j , pac4j-core, pac4j-oauth are pinned to specific versions, and does not work when they are upgraded.
  • These pinned version contains log4j in their downstream packages and we can't upgrade them because higher version of them don't work with the latest zeppelin, hence there is a need to remove the OAuth feature from zeppelin to avoid these CVEs

Changes

  • Remove auth related libraries and build the zeppelin for only 3.4.1 and not override the other images

@Tingweiftw Tingweiftw merged commit 1fd5f8e into master Nov 30, 2023
3 checks passed
@Tingweiftw Tingweiftw deleted the chore--remove-log4j-libraries branch November 30, 2023 13:36
@Tingweiftw Tingweiftw restored the chore--remove-log4j-libraries branch November 30, 2023 13:39
@Tingweiftw
Copy link
Contributor Author

There is a need to disable shiro for it to work

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant