From 80a5cb02f815352c90b79ee31dfdeb69d5185c76 Mon Sep 17 00:00:00 2001 From: Aseem Bansal Date: Thu, 5 May 2022 10:01:36 +0530 Subject: [PATCH 1/4] fix security issues due to transitive dependency icu4j --- CHANGELOG.md | 1 + build.gradle | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8042469bfd..8e6894f9b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ When updating the changelog, remember to be very clear about what behavior has c and what APIs have changed, if applicable. ## [Unreleased] +- Update antlr dependency to fix security issues. ## [29.33.6] - 2022-05-03 - Provide a mechanism to set a routing hint for the d2 request to get request symbol table. diff --git a/build.gradle b/build.gradle index c0471b4c10..38a5c940e8 100644 --- a/build.gradle +++ b/build.gradle @@ -43,8 +43,8 @@ apply from: environmentScript apply from: "${buildScriptDirPath}/configBuildScript.gradle" project.ext.externalDependency = [ - 'antlr': 'org.antlr:antlr4:4.5', - 'antlrRuntime': 'org.antlr:antlr4-runtime:4.5', + 'antlr': 'org.antlr:antlr4:4.10.1', + 'antlrRuntime': 'org.antlr:antlr4-runtime:4.10.1', 'avro': 'org.apache.avro:avro:1.9.2', 'avro_1_6': 'org.apache.avro:avro:1.6.3', // avro compatibility layer From ee52ece9dac01ebd84bc4606e76f8aabe854481b Mon Sep 17 00:00:00 2001 From: Aseem Bansal Date: Fri, 6 May 2022 19:08:26 +0530 Subject: [PATCH 2/4] lower antlr4 to 4.9.3 to see compatibility with Java 8 --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 38a5c940e8..8a0d8fcb5c 100644 --- a/build.gradle +++ b/build.gradle @@ -43,8 +43,8 @@ apply from: environmentScript apply from: "${buildScriptDirPath}/configBuildScript.gradle" project.ext.externalDependency = [ - 'antlr': 'org.antlr:antlr4:4.10.1', - 'antlrRuntime': 'org.antlr:antlr4-runtime:4.10.1', + 'antlr': 'org.antlr:antlr4:4.9.3', + 'antlrRuntime': 'org.antlr:antlr4-runtime:4.9.3', 'avro': 'org.apache.avro:avro:1.9.2', 'avro_1_6': 'org.apache.avro:avro:1.6.3', // avro compatibility layer From cea1ece2ec4470e44abe215a1b73e21ef8a1555e Mon Sep 17 00:00:00 2001 From: Aseem Bansal Date: Wed, 11 May 2022 16:47:20 +0530 Subject: [PATCH 3/4] reduce the version which compiles --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 8a0d8fcb5c..8e6f7e7002 100644 --- a/build.gradle +++ b/build.gradle @@ -43,8 +43,8 @@ apply from: environmentScript apply from: "${buildScriptDirPath}/configBuildScript.gradle" project.ext.externalDependency = [ - 'antlr': 'org.antlr:antlr4:4.9.3', - 'antlrRuntime': 'org.antlr:antlr4-runtime:4.9.3', + 'antlr': 'org.antlr:antlr4:4.6', + 'antlrRuntime': 'org.antlr:antlr4-runtime:4.6', 'avro': 'org.apache.avro:avro:1.9.2', 'avro_1_6': 'org.apache.avro:avro:1.6.3', // avro compatibility layer From b801bc7390ca80c199a513a466fe80270bbd4489 Mon Sep 17 00:00:00 2001 From: Aseem Bansal Date: Thu, 19 May 2022 18:36:15 +0530 Subject: [PATCH 4/4] fix wrong annotation --- .../d2/discovery/stores/zk/acl/AclAwareZookeeper.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/d2/src/main/java/com/linkedin/d2/discovery/stores/zk/acl/AclAwareZookeeper.java b/d2/src/main/java/com/linkedin/d2/discovery/stores/zk/acl/AclAwareZookeeper.java index 7c06bc7161..f9578499e3 100644 --- a/d2/src/main/java/com/linkedin/d2/discovery/stores/zk/acl/AclAwareZookeeper.java +++ b/d2/src/main/java/com/linkedin/d2/discovery/stores/zk/acl/AclAwareZookeeper.java @@ -20,7 +20,6 @@ import com.linkedin.d2.discovery.stores.zk.ZKPersistentConnection; import com.linkedin.d2.discovery.stores.zk.ZooKeeper; import java.util.List; -import org.antlr.v4.runtime.misc.NotNull; import org.apache.zookeeper.AsyncCallback; import org.apache.zookeeper.CreateMode; import org.apache.zookeeper.KeeperException; @@ -30,6 +29,7 @@ import org.apache.zookeeper.data.Stat; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import javax.annotation.Nonnull; /** @@ -44,7 +44,7 @@ public class AclAwareZookeeper extends AbstractZooKeeper private final ZKAclProvider _aclProvider; - public AclAwareZookeeper(@NotNull ZooKeeper zooKeeper, @NotNull ZKAclProvider aclProvider) + public AclAwareZookeeper(@Nonnull ZooKeeper zooKeeper, @Nonnull ZKAclProvider aclProvider) { super(zooKeeper); _aclProvider = aclProvider;