Reverted pulsar version to 3.2.2 while fixing avro vulnerability

datastax · Dec 19, 2024 · f4fea6e · f4fea6e
1 parent 7b25426
commit f4fea6e
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 2 deletions.
diff --git a/examples/spring/pom.xml b/examples/spring/pom.xml
@@ -46,7 +46,7 @@
     <dependency>
       <!-- DataStax Apache Pulsar JMS Client -->
       <groupId>com.datastax.oss</groupId>
-      <artifactId>pulsar-jms-all</artifactId>
+      <artifactId>pulsar-jms</artifactId>
       <version>${project.version}</version>
     </dependency>
     <dependency>

diff --git a/pom.xml b/pom.xml
@@ -55,7 +55,7 @@
     <maven.compiler.release>17</maven.compiler.release>
     <jms.version>3.0.0</jms.version>
     <pulsar.groupId>org.apache.pulsar</pulsar.groupId>
-    <pulsar.version>3.3.2</pulsar.version>
+    <pulsar.version>3.2.2</pulsar.version>
     <activemq.version>6.0.0</activemq.version>
     <hawtbuf.version>1.11</hawtbuf.version>
     <curator.version>5.1.0</curator.version>
@@ -130,6 +130,26 @@
         <groupId>${pulsar.groupId}</groupId>
         <artifactId>pulsar-client-original</artifactId>
         <version>${pulsar.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.apache.avro</groupId>
+            <artifactId>avro</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.avro</groupId>
+            <artifactId>avro-protobuf</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.avro</groupId>
+        <artifactId>avro</artifactId>
+        <version>1.11.4</version>
+      </dependency>
+      <dependency>
+        <groupId>org.apache.avro</groupId>
+        <artifactId>avro-protobuf</artifactId>
+        <version>1.11.4</version>
       </dependency>
       <dependency>
         <groupId>${pulsar.groupId}</groupId>

diff --git a/pulsar-jms/pom.xml b/pulsar-jms/pom.xml
@@ -54,6 +54,26 @@
     <dependency>
       <groupId>${pulsar.groupId}</groupId>
       <artifactId>pulsar-client-original</artifactId>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro-protobuf</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.avro</groupId>
+      <artifactId>avro</artifactId>
+      <version>1.11.4</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.avro</groupId>
+      <artifactId>avro-protobuf</artifactId>
+      <version>1.11.4</version>
     </dependency>
     <dependency>
       <groupId>${pulsar.groupId}</groupId>