Skip to content

pin commons-configuration2 version to 2.15.0#38779

Draft
derrickaw wants to merge 4 commits into
apache:masterfrom
derrickaw:20260602_pinconfiguration2
Draft

pin commons-configuration2 version to 2.15.0#38779
derrickaw wants to merge 4 commits into
apache:masterfrom
derrickaw:20260602_pinconfiguration2

Conversation

@derrickaw
Copy link
Copy Markdown
Collaborator

@derrickaw derrickaw commented Jun 2, 2026

  1. Pin commons-configuration2 version to 2.15.0 instead of 2.10.1 dependency to remove vulnerability.
  2. Pin commons-io to higher version to support 2.15.

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

  • Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
  • Update CHANGES.md with noteworthy changes.
  • If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

Build python source distribution and wheels
Python tests
Java tests
Go tests

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

@github-actions github-actions Bot added the build label Jun 2, 2026
@derrickaw
Copy link
Copy Markdown
Collaborator Author

/gemini review

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request upgrades commons_io to version 2.19.0 and forces the use of commons-configuration2:2.15.0 in the HBase and Iceberg Hive subprojects. The reviewer recommends centralizing the definition of commons_configuration2 in BeamModulePlugin.groovy and referencing it in the subprojects' build files to avoid hardcoding dependency coordinates across multiple files.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

commons_compress : "org.apache.commons:commons-compress:1.26.2",
commons_csv : "org.apache.commons:commons-csv:1.8",
commons_io : "commons-io:commons-io:2.16.1",
commons_io : "commons-io:commons-io:2.19.0",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Define commons_configuration2 centrally in BeamModulePlugin.groovy so that it can be referenced across subprojects (like hbase and iceberg) instead of hardcoding the version string in multiple places.

        commons_configuration2                      : "org.apache.commons:commons-configuration2:2.15.0",
        commons_io                                  : "commons-io:commons-io:2.19.0",

configurations.all {
resolutionStrategy {
// TODO: remove after higher version of hbase (>2.6.5) contains this minimum version.
force 'org.apache.commons:commons-configuration2:2.15.0'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To maintain centralized dependency management, avoid hardcoding the dependency coordinates and version here. Instead, reference the centralized dependency from BeamModulePlugin.groovy using library.java.commons_configuration2.

    force library.java.commons_configuration2

exclude group: "org.apache.parquet", module: "parquet-hadoop-bundle"
// TODO: remove after higher version of hbase (>2.6.5) contains this minimum version.
resolutionStrategy {
force 'org.apache.commons:commons-configuration2:2.15.0'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To maintain centralized dependency management, avoid hardcoding the dependency coordinates and version here. Instead, reference the centralized dependency from BeamModulePlugin.groovy using library.java.commons_configuration2.

        force library.java.commons_configuration2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant