Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

treewide: update "guava" package #369

Closed
wants to merge 1 commit into from

Conversation

tchaikov
Copy link
Contributor

update "guava" package from 18.0 to 32.1.3.

Update the version of guava dependency to 31.1.3-jre. Before the change, security scanners (such as Trivy) reported that guava used in the project was vulnerable to CVE-2018-10237 and CVE-2023-2976 (both "MEDIUM" severify and CVE-2020-8908 as "LOW" severity (both "HIGH" severity).

Those issues were fixed in guava 31.1.3 and after this commit the security scanner doesn't report any problems related to this dependency.

because guava 31 introduced quite a few non-backward compatible changes, we have to address them on a case-by-case basis.

previous this change was reverted in
3963c3a because it missed the change to address the incompatible API changes.

Fixes: #365

update "guava" package from 18.0 to 32.1.3.

Update the version of guava dependency to 31.1.3-jre. Before the change,
security scanners (such as Trivy) reported that `guava` used
in the project was vulnerable to CVE-2018-10237 and CVE-2023-2976 (both
"MEDIUM" severify and CVE-2020-8908 as "LOW" severity
(both "HIGH" severity).

Those issues were fixed in guava 31.1.3 and after this commit the security
scanner doesn't report any problems related to this dependency.

because guava 31 introduced quite a few non-backward compatible changes,
we have to address them on a case-by-case basis.

previous this change was reverted in
3963c3a because it missed the change to
address the incompatible API changes.

Fixes: scylladb#365

Signed-off-by: Kefu Chai <[email protected]>
@tchaikov tchaikov requested a review from yaronkaikov December 20, 2023 13:18
Copy link
Contributor

@yaronkaikov yaronkaikov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @tchaikov for your help with that

@yaronkaikov
Copy link
Contributor

@scylladb/scylla-maint Can you please merge this and update the submodule ?

@denesb denesb closed this in 43427df Dec 20, 2023
@tchaikov tchaikov deleted the guava-32.1.3 branch December 20, 2023 14:19
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```

Since in the the update `Guava` version we started to use
`getHostText()` was deprecated and changed to `getHost()`
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```

Since in the the update `Guava` version we started to use
`getHostText()` was deprecated and changed to `getHost()`
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```

bump guava version to 32.1.3-jre
Since in the the update `Guava` version we started to use
`getHostText()` was deprecated and changed to `getHost()`
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```

bump guava version to 32.1.3-jre
Since in the the update `Guava` version we started to use
`getHostText()` was deprecated and changed to `getHost()`
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```

bump guava version to 32.1.3-jre
Since in the the update `Guava` version we started to use
`getHostText()` was deprecated and changed to `getHost()`
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```

Since in the the update `Guava` version we started to use
`getHostText()` was deprecated and changed to `getHost()`
yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 21, 2023
…g.NoSuchMethodError

Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```
@roydahan
Copy link
Collaborator

@yaronkaikov so this one is in?
I thought you were saying it will break next if it gets in.

@yaronkaikov
Copy link
Contributor

It merged here, but the submodule is not updated in Scylla core until we fix scylladb/java-driver#267

yaronkaikov added a commit to yaronkaikov/java-driver that referenced this pull request Dec 26, 2023
…g.NoSuchMethodError

Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```
@roydahan
Copy link
Collaborator

roydahan commented Jan 2, 2024

@avelanarius FYI

avelanarius pushed a commit to yaronkaikov/java-driver that referenced this pull request Jan 3, 2024
…g.NoSuchMethodError

Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```
roydahan pushed a commit to scylladb/java-driver that referenced this pull request Jan 4, 2024
…g.NoSuchMethodError

Following the changed made in
scylladb/scylla-tools-java#369, dtest is now
failing during `test_connectivity_with_cassandra_stress` with the
following error:
```
stderr: java.lang.NoSuchMethodError: 'java.lang.String com.google.common.net.HostAndPort.getHostText()'
	at com.datastax.driver.core.ScyllaCloudDatacenter.getServer(ScyllaCloudDatacenter.java:77)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1404)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1397)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1393)
	at com.datastax.driver.core.Cluster$Builder.withScyllaCloudConnectionConfig(Cluster.java:1389)
	at org.apache.cassandra.stress.util.JavaDriverClient.connect(JavaDriverClient.java:181)
	at org.apache.cassandra.stress.settings.StressSettings.getJavaDriverClient(StressSettings.java:213)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpacesNative(SettingsSchema.java:84)
	at org.apache.cassandra.stress.settings.SettingsSchema.createKeySpaces(SettingsSchema.java:74)
	at org.apache.cassandra.stress.settings.StressSettings.maybeCreateKeyspaces(StressSettings.java:230)
	at org.apache.cassandra.stress.StressAction.run(StressAction.java:58)
	at org.apache.cassandra.stress.Stress.run(Stress.java:143)
	at org.apache.cassandra.stress.Stress.main(Stress.java:62)
```
yaronkaikov added a commit to yaronkaikov/scylla-tools-java that referenced this pull request Jan 7, 2024
New release is needed for
scylladb/scylladb#16491 to pass CI so we can
promote scylladb#369
yaronkaikov added a commit to yaronkaikov/scylla-tools-java that referenced this pull request Jan 7, 2024
New release is needed for
scylladb/scylladb#16491 to pass CI so we can
promote scylladb#369

Fixes: scylladb#343
nyh pushed a commit that referenced this pull request Jan 7, 2024
New release is needed for
scylladb/scylladb#16491 to pass CI so we can
promote #369

Fixes: #343

Closes #372
denesb pushed a commit that referenced this pull request Jan 9, 2024
update "guava" package from 18.0 to 32.1.3.

Update the version of guava dependency to 31.1.3-jre. Before the change,
security scanners (such as Trivy) reported that `guava` used
in the project was vulnerable to CVE-2018-10237 and CVE-2023-2976 (both
"MEDIUM" severify and CVE-2020-8908 as "LOW" severity
(both "HIGH" severity).

Those issues were fixed in guava 31.1.3 and after this commit the security
scanner doesn't report any problems related to this dependency.

because guava 31 introduced quite a few non-backward compatible changes,
we have to address them on a case-by-case basis.

previous this change was reverted in
3963c3a because it missed the change to
address the incompatible API changes.

Fixes: #365
Closes: #369

Signed-off-by: Kefu Chai <[email protected]>
(cherry picked from commit 43427df)
denesb pushed a commit that referenced this pull request Jan 9, 2024
update "guava" package from 18.0 to 32.1.3.

Update the version of guava dependency to 31.1.3-jre. Before the change,
security scanners (such as Trivy) reported that `guava` used
in the project was vulnerable to CVE-2018-10237 and CVE-2023-2976 (both
"MEDIUM" severify and CVE-2020-8908 as "LOW" severity
(both "HIGH" severity).

Those issues were fixed in guava 31.1.3 and after this commit the security
scanner doesn't report any problems related to this dependency.

because guava 31 introduced quite a few non-backward compatible changes,
we have to address them on a case-by-case basis.

previous this change was reverted in
3963c3a because it missed the change to
address the incompatible API changes.

Fixes: #365
Closes: #369

Signed-off-by: Kefu Chai <[email protected]>
(cherry picked from commit 43427df)
denesb pushed a commit that referenced this pull request Jan 9, 2024
New release is needed for
scylladb/scylladb#16491 to pass CI so we can
promote #369

Fixes: #343

Closes #372

(cherry picked from commit e106b50)
denesb pushed a commit that referenced this pull request Jan 9, 2024
New release is needed for
scylladb/scylladb#16491 to pass CI so we can
promote #369

Fixes: #343

Closes #372

(cherry picked from commit e106b50)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Old version of guava dependencies
3 participants