Release 5.7.3

CHANGELOG

@@ -1,3 +1,10 @@
+Version 5.7.3 (2023-09-07)
+--------------------------
+Bump jackson-mapper-asl to 1.9.14-atlassian-6 (#1312)
+Loader: exclude unnecessary hadoop dependencies (#1312)
+Bump snappy-java to 1.1.10.3 (#1312)
+Bump jettison to 1.5.4 (#1312)
+
 Version 5.7.2 (2023-08-24)
 --------------------------
 Ensure docker image has the latest jdk version (#1311)

README.md

@@ -65,7 +65,7 @@ Licensed under the [Snowplow Community License](https://docs.snowplow.io/communi
 [build-image]: https://github.com/snowplow/snowplow-rdb-loader/workflows/CI/badge.svg
 [build]: https://github.com/snowplow/snowplow-rdb-loader/actions/workflows/ci.yml
 
-[release-image]: https://img.shields.io/badge/release-5.7.2-blue.svg?style=flat
+[release-image]: https://img.shields.io/badge/release-5.7.3-blue.svg?style=flat
 [releases]: https://github.com/snowplow/snowplow-rdb-loader/releases
 
 [license]: https://docs.snowplow.io/docs/contributing/community-license-faq/

build.sbt

@@ -69,13 +69,14 @@ lazy val commonTransformerStream = project
   .settings(BuildSettings.commonStreamTransformerBuildSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.commonStreamTransformerDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(common % "compile->compile;test->test")
   .enablePlugins(BuildInfoPlugin)
 
 lazy val loader = project
   .in(file("modules/loader"))
   .settings(BuildSettings.loaderBuildSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.loaderDependencies)
   .dependsOn(
@@ -88,6 +89,7 @@ lazy val redshiftLoader = project
   .in(file("modules/redshift-loader"))
   .settings(BuildSettings.redshiftBuildSettings)
   .settings(BuildSettings.additionalDockerSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.redshiftDependencies)
   .dependsOn(loader % "compile->compile;test->test;runtime->runtime")
@@ -98,6 +100,7 @@ lazy val redshiftLoaderDistroless = project
   .settings(sourceDirectory := (redshiftLoader / sourceDirectory).value)
   .settings(BuildSettings.redshiftBuildSettings)
   .settings(BuildSettings.additionalDockerSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.redshiftDependencies)
   .dependsOn(loader % "compile->compile;test->test;runtime->runtime")
@@ -107,6 +110,7 @@ lazy val snowflakeLoader = project
   .in(file("modules/snowflake-loader"))
   .settings(BuildSettings.snowflakeBuildSettings)
   .settings(BuildSettings.additionalDockerSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.snowflakeDependencies)
   .dependsOn(common % "compile->compile;test->test",loader % "compile->compile;test->test;runtime->runtime")
@@ -117,6 +121,7 @@ lazy val snowflakeLoaderDistroless = project
   .settings(sourceDirectory := (snowflakeLoader / sourceDirectory).value)
   .settings(BuildSettings.snowflakeBuildSettings)
   .settings(BuildSettings.additionalDockerSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.snowflakeDependencies)
   .dependsOn(loader % "compile->compile;test->test;runtime->runtime")
@@ -126,6 +131,7 @@ lazy val databricksLoader = project
   .in(file("modules/databricks-loader"))
   .settings(BuildSettings.databricksBuildSettings)
   .settings(BuildSettings.additionalDockerSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .dependsOn(loader % "compile->compile;test->test;runtime->runtime")
   .enablePlugins(JavaAppPackaging, SnowplowDockerPlugin, BuildInfoPlugin)
@@ -135,6 +141,7 @@ lazy val databricksLoaderDistroless = project
   .settings(sourceDirectory := (databricksLoader / sourceDirectory).value)
   .settings(BuildSettings.databricksBuildSettings)
   .settings(BuildSettings.additionalDockerSettings)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .dependsOn(loader % "compile->compile;test->test;runtime->runtime")
   .enablePlugins(JavaAppPackaging, SnowplowDistrolessDockerPlugin, BuildInfoPlugin)
@@ -152,7 +159,7 @@ lazy val transformerKinesis = project
   .settings(BuildSettings.additionalDockerSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.transformerKinesisDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(commonTransformerStream % "compile->compile;test->test;runtime->runtime", aws % "compile->compile;test->test;runtime->runtime")
   .enablePlugins(JavaAppPackaging, SnowplowDockerPlugin, BuildInfoPlugin)
 
@@ -163,7 +170,7 @@ lazy val transformerKinesisDistroless = project
   .settings(BuildSettings.additionalDockerSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.transformerKinesisDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(commonTransformerStream % "compile->compile;test->test;runtime->runtime", aws % "compile->compile;test->test;runtime->runtime")
   .enablePlugins(JavaAppPackaging, SnowplowDistrolessDockerPlugin, BuildInfoPlugin)
 
@@ -173,7 +180,7 @@ lazy val transformerPubsub = project
   .settings(BuildSettings.additionalDockerSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.transformerPubsubDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(commonTransformerStream % "compile->compile;test->test;runtime->runtime", gcp % "compile->compile;test->test")
   .enablePlugins(JavaAppPackaging, SnowplowDockerPlugin, BuildInfoPlugin)
 
@@ -184,7 +191,7 @@ lazy val transformerPubsubDistroless = project
   .settings(BuildSettings.additionalDockerSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.transformerPubsubDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(commonTransformerStream % "compile->compile;test->test;runtime->runtime", gcp % "compile->compile;test->test")
   .enablePlugins(JavaAppPackaging, SnowplowDistrolessDockerPlugin, BuildInfoPlugin)
 
@@ -194,7 +201,7 @@ lazy val transformerKafka = project
   .settings(BuildSettings.additionalDockerSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.transformerKafkaDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(commonTransformerStream % "compile->compile;test->test;runtime->runtime", azure % "compile->compile;test->test;runtime->runtime")
   .enablePlugins(JavaAppPackaging, SnowplowDockerPlugin, BuildInfoPlugin)
 
@@ -206,6 +213,6 @@ lazy val transformerKafkaDistroless = project
   .settings(BuildSettings.additionalDockerSettings)
   .settings(addCompilerPlugin(Dependencies.betterMonadicFor))
   .settings(libraryDependencies ++= Dependencies.transformerKafkaDependencies)
-  .settings(excludeDependencies ++= Dependencies.commonStreamTransformerExclusions)
+  .settings(excludeDependencies ++= Dependencies.commonExclusions)
   .dependsOn(commonTransformerStream % "compile->compile;test->test;runtime->runtime", azure % "compile->compile;test->test")
   .enablePlugins(JavaAppPackaging, SnowplowDistrolessDockerPlugin, BuildInfoPlugin)

project/Dependencies.scala

@@ -45,13 +45,14 @@ object Dependencies {
     val schemaDdl        = "0.18.2"
     val jacksonModule    = "2.14.2" // Override incompatible version in spark runtime
     val jacksonDatabind  = "2.14.2"
+    val jacksonMapper    = "1.9.14-atlassian-6" // Fix CVE
     val parquet4s        = "2.10.0"
     val hadoopClient     = "3.3.4"
     val hadoopGcpClient  = "hadoop3-2.2.5"
     val parquetHadoop    = "1.12.3"
     val jsonSmart        = "2.4.9" // Fix CVE
     val nimbusJose       = "9.31" // Fix CVE
-    val snappyJava       = "1.1.10.1" // Fix CVE
+    val snappyJava       = "1.1.10.3" // Fix CVE
     val commonsText      = "1.10.0" // Fix CVE
     val ivy              = "2.5.1" // Fix CVE
 
@@ -66,6 +67,7 @@ object Dependencies {
     val protobuf         = "3.21.7" // Fix CVE
     val kinesisClient    = "2.4.3"
     val nettyCodec       = "4.1.86.Final" // Fix CVE
+    val jettison         = "1.5.4" // Fix CVE
 
     // Scala (test only)
     val specs2           = "4.17.0"
@@ -80,7 +82,8 @@ object Dependencies {
   val resolutionRepos = Seq(
     // Redshift native driver
     ("redshift" at "http://redshift-maven-repository.s3-website-us-east-1.amazonaws.com/release").withAllowInsecureProtocol(true),
-    ("Snowplow Analytics Maven repo" at "http://maven.snplow.com/releases/").withAllowInsecureProtocol(true)
+    ("Snowplow Analytics Maven repo" at "http://maven.snplow.com/releases/").withAllowInsecureProtocol(true),
+    ("Atlassian Maven repo" at "https://packages.atlassian.com/mvn/maven-3rdparty/")
   )
 
   // Scala (Common)
@@ -139,6 +142,7 @@ object Dependencies {
   val jacksonModule     = "com.fasterxml.jackson.module"     %% "jackson-module-scala"     % V.jacksonModule
   val jacksonDatabind   = "com.fasterxml.jackson.core"       %  "jackson-databind"         % V.jacksonDatabind
   val jacksonCbor       = "com.fasterxml.jackson.dataformat" % "jackson-dataformat-cbor"   % V.jacksonModule
+  val jacksonMapper     = "org.codehaus.jackson"             % "jackson-mapper-asl"        % V.jacksonMapper
   val parquet4s         = "com.github.mjakubowski84"         %% "parquet4s-fs2"            % V.parquet4s
   val hadoopCommon      = ("org.apache.hadoop"               % "hadoop-common"             % V.hadoopClient)
     .exclude("com.jcraft", "jsch")
@@ -166,6 +170,7 @@ object Dependencies {
   val sentry            = "io.sentry"             % "sentry"                    % V.sentry
   val snowflakeJdbc     = "net.snowflake"         % "snowflake-jdbc"            % V.snowflakeJdbc
   val enumeratum        = "com.beachape"          %% "enumeratum"               % V.enumeratum
+  val jettison          = "org.codehaus.jettison" % "jettison"                  % V.jettison
 
   // Java (Shredder)
   val dynamodb          = "com.amazonaws"         % "aws-java-sdk-dynamodb"     % V.aws
@@ -244,6 +249,7 @@ object Dependencies {
     http4sCore,
     aws2regions,
     jacksonDatabind,
+    jacksonMapper,
     specs2,
     monocle,
     monocleMacro,
@@ -277,6 +283,8 @@ object Dependencies {
     specs2,
     specs2ScalaCheck,
     scalaCheck,
+    jettison,
+    snappyJava,
     catsEffectLaws,
     catsTesting,
     catsEffectTestkit
@@ -346,10 +354,11 @@ object Dependencies {
 
   val transformerKafkaDependencies = Seq(
     hadoopAzure,
+    jettison,
     eventGenerator
   )
 
-  val commonStreamTransformerExclusions =
+  val commonExclusions =
     Seq(
       ExclusionRule(organization = "ch.qos.logback"),
       ExclusionRule(organization = "org.apache.hadoop", name = "hadoop-yarn-api"),