Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Testkit & tests: Sort out some dependencies with security warnings #928

Merged
merged 2 commits into from
Oct 10, 2019

Conversation

ennru
Copy link
Member

@ennru ennru commented Oct 9, 2019

Purpose

Avoid security warnings for vulnerable libraries.

Changes

  • Testkit, when Kafka is used: Commons compress 1.19, Jackson Databind 2.9.10
  • Tests: Jackson databind 2.10.0
  • Tests: Confluent Avro 5.0.3
  • Tests: Remove Akka typed which is not used

@ennru ennru added this to the 1.1.0 milestone Oct 9, 2019
@seglo seglo self-requested a review October 10, 2019 02:06
Copy link
Contributor

@seglo seglo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems to be a bug with the integration build.

Exception in thread "shutdownHook1" java.lang.NoSuchMethodError: akka.actor.ActorSystem.shutdown()V
	at com.github.ehsanyou.sbt.docker.compose.DockerCompose$.$anonfun$actorSystem$1(DockerCompose.scala:74)
	at scala.sys.ShutdownHookThread$$anon$1.run(ShutdownHookThread.scala:33)

https://travis-ci.org/akka/alpakka-kafka/jobs/595824305#L7972

@ennru
Copy link
Member Author

ennru commented Oct 10, 2019

Yes, the docker-compose plugin is compiled against an old Akka version, that doesn't affect the tests though.

@ennru ennru changed the title Testkit: Commons compress 1.19, Tests: Jackson databind 2.10.0 Testkit & tests: Sort out some dependencies with security warnings Oct 10, 2019
@ennru ennru requested a review from johanandren October 10, 2019 06:21
"org.scalatest" %% "scalatest" % scalatestVersion % Test,
"io.spray" %% "spray-json" % "1.3.5" % Test,
"com.fasterxml.jackson.core" % "jackson-databind" % "2.9.8" % Test, // ApacheV2
"com.fasterxml.jackson.core" % "jackson-databind" % "2.10.0" % Test, // ApacheV2
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good that we are using the same Jackson version in all Lightbend products (Akka, Play, Lagom, ...)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is just in the non-published tests, in the testkit I didn't dare to go past 2.9.10.

@ennru ennru merged commit 0033aa9 into akka:master Oct 10, 2019
@ennru ennru deleted the security-updates branch October 10, 2019 06:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants