From ac5d8d3dca727659300616f843098ce304e959e8 Mon Sep 17 00:00:00 2001
From: chenpingzeng <chenpingzeng@huawei.com>
Date: Wed, 8 Jun 2022 15:16:51 +0800
Subject: [PATCH] upgrade software dependency to solve CVEs

Signed-off-by: chenpingzeng <chenpingzeng@huawei.com>
---
 hetu-hazelcast/pom.xml        |  2 +-
 hetu-hbase/pom.xml            |  4 ++--
 pom.xml                       |  4 ++--
 presto-elasticsearch/pom.xml  |  2 +-
 presto-memory/pom.xml         |  2 +-
 presto-record-decoder/pom.xml | 11 +++++++++++
 presto-redis/pom.xml          | 11 +++++++++++
 7 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/hetu-hazelcast/pom.xml b/hetu-hazelcast/pom.xml
index 0fedbe758..b4f17a703 100644
--- a/hetu-hazelcast/pom.xml
+++ b/hetu-hazelcast/pom.xml
@@ -17,7 +17,7 @@
         <jline.version>3.21.0</jline.version>
         <hazelcast.version>5.1</hazelcast.version>
         <aspectjweaver.version>1.9.4</aspectjweaver.version>
-        <spring-context.version>5.2.19.RELEASE</spring-context.version>
+        <spring-context.version>5.3.20</spring-context.version>
         <cache-api.version>1.1.1</cache-api.version>
         <jmockit.version>1.38</jmockit.version>
     </properties>
diff --git a/hetu-hbase/pom.xml b/hetu-hbase/pom.xml
index c3dda55fa..8fe320643 100644
--- a/hetu-hbase/pom.xml
+++ b/hetu-hbase/pom.xml
@@ -14,7 +14,7 @@
 
     <properties>
         <air.main.basedir>${project.parent.basedir}</air.main.basedir>
-        <dep.log4j.version>2.17.1</dep.log4j.version>
+        <dep.log4j.version>2.17.2</dep.log4j.version>
         <version.annotations>13.0</version.annotations>
         <version.validation-api>2.0.1.Final</version.validation-api>
         <version.commons-lang3>3.10</version.commons-lang3>
@@ -249,7 +249,7 @@
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-webapp</artifactId>
-            <version>9.4.43.v20210629</version>
+            <version>9.4.46.v20220331</version>
             <scope>runtime</scope>
         </dependency>
         <dependency>
diff --git a/pom.xml b/pom.xml
index 11d15c711..f4150e8b9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -59,7 +59,7 @@
         <dep.prestosql.version>316</dep.prestosql.version>
         <dep.jackson.version>2.11.4</dep.jackson.version>
         <dep.hetu.version>${project.version}</dep.hetu.version>
-        <dep.jetty.version>9.4.43.v20210629</dep.jetty.version>
+        <dep.jetty.version>9.4.46.v20220331</dep.jetty.version>
         <dep.bcprov.version>1.66</dep.bcprov.version>
         <dep.hudi.version>0.7.0</dep.hudi.version>
         <dep.kryo.version>5.0.3</dep.kryo.version>
@@ -912,7 +912,7 @@
             <dependency>
                 <groupId>mysql</groupId>
                 <artifactId>mysql-connector-java</artifactId>
-                <version>5.1.47</version>
+                <version>5.1.49</version>
             </dependency>
 
             <dependency>
diff --git a/presto-elasticsearch/pom.xml b/presto-elasticsearch/pom.xml
index 33ffd5e4b..a14378857 100644
--- a/presto-elasticsearch/pom.xml
+++ b/presto-elasticsearch/pom.xml
@@ -14,7 +14,7 @@
 
     <properties>
         <air.main.basedir>${project.parent.basedir}</air.main.basedir>
-        <dep.log4j.version>2.17.1</dep.log4j.version>
+        <dep.log4j.version>2.17.2</dep.log4j.version>
         <dep.elasticsearch.version>6.0.0</dep.elasticsearch.version>
         <httpcore-nio.version>4.4.5</httpcore-nio.version>
     </properties>
diff --git a/presto-memory/pom.xml b/presto-memory/pom.xml
index 98db38a74..4e12a6a05 100644
--- a/presto-memory/pom.xml
+++ b/presto-memory/pom.xml
@@ -205,7 +205,7 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-test</artifactId>
-            <version>5.2.19.RELEASE</version>
+            <version>5.3.20</version>
             <scope>test</scope>
             <exclusions>
                 <exclusion>
diff --git a/presto-record-decoder/pom.xml b/presto-record-decoder/pom.xml
index fe9e99be9..24b680411 100644
--- a/presto-record-decoder/pom.xml
+++ b/presto-record-decoder/pom.xml
@@ -70,9 +70,20 @@
                     <groupId>com.fasterxml.jackson.core</groupId>
                     <artifactId>jackson-databind</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-compress</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
+            <version>1.21</version>
+            <scope>runtime</scope>
+        </dependency>
+
         <dependency>
             <groupId>org.xerial.snappy</groupId>
             <artifactId>snappy-java</artifactId>
diff --git a/presto-redis/pom.xml b/presto-redis/pom.xml
index 4fe548a1c..c9dfc0fb5 100644
--- a/presto-redis/pom.xml
+++ b/presto-redis/pom.xml
@@ -185,9 +185,20 @@
                     <groupId>org.slf4j</groupId>
                     <artifactId>slf4j-api</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-compress</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
+            <version>1.21</version>
+            <scope>runtime</scope>
+        </dependency>
+
         <dependency>
             <groupId>org.testng</groupId>
             <artifactId>testng</artifactId>