upgrade dependencies to make it compatible with AD #4412
Conversation
Signed-off-by: Jackie <[email protected]>
jackiehanyang
requested review from
HenryL27,
Zhangxunmt,
austintlee,
b4sjoo,
dhrubo-os,
jngz-es,
mingshl,
model-collapse,
pyek-bot,
rbhavna,
sam-herman,
xinyual,
ylwu-amzn and
zane-neo
as code owners
jackiehanyang
had a problem deploying
to
ml-commons-cicd-env-require-approval
GitHub Actions
Error
jackiehanyang
had a problem deploying
to
ml-commons-cicd-env-require-approval
GitHub Actions
Failure
jackiehanyang
had a problem deploying
to
ml-commons-cicd-env-require-approval
GitHub Actions
Error
jackiehanyang
had a problem deploying
to
ml-commons-cicd-env-require-approval
GitHub Actions
Failure
| configurations.all { | ||
| // Force spotless depending on newer version of guava due to CVE-2023-2976. Remove after spotless upgrades. | ||
| resolutionStrategy.force "com.google.guava:guava:32.1.3-jre" | ||
| resolutionStrategy.force "com.google.guava:guava:33.4.5-jre" |
There was a problem hiding this comment.
May be both plugins can take version from core: https://github.com/opensearch-project/OpenSearch/blob/main/gradle/libs.versions.toml#L23 ?
There was a problem hiding this comment.
No, AD needs it for a resource permission related change from security plugin side - opensearch-project/anomaly-detection@ee8e38d They are planning to make this change for all plugins just AD is the first one onboarded
| configurations.all { | ||
| // Force spotless depending on newer version of guava due to CVE-2023-2976. Remove after spotless upgrades. | ||
| resolutionStrategy.force "com.google.guava:guava:32.1.3-jre" | ||
| resolutionStrategy.force "com.google.guava:guava:33.4.5-jre" |
There was a problem hiding this comment.
NIT:
We are forcing the newer version in the root module, but looks like other modules still declare older versions 32.1.3
Should we change it in all the packages as well? This would be more for overall consistency since the resolutionStrategy.force in the root module would ensure all the modules use the latest version declared here.
3 participants
Description
In AD Detection Insights feature, we're calling ml-commons metrics correlation algorithm from AD which adds ml-commons as a runtime dependency. So making some dependency updates to make AD and ml-commons run in the same JVM runtime inside that container and communicate via transport actions.
Related Issues
Resolves #[Issue number to be closed when this PR is merged]
Check List
--signoff.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.