ARROW-16996: [Java] Configure Netty/GRPC/Protobuf base on BOM configu…

…ration + upgrade of dependencies by CVE (apache#13544) - Configure Netty/GRPC/Protobuf base on BOM Bill Of Material configuration to dependencies versions be added by configuration (netty/netty#5994). - Upgrade Netty/GRPC/Protobuf dependencies. Netty [CVE](GHSA-269q-hmxg-m83q) Authored-by: david dali susanibar arce <[email protected]> Signed-off-by: David Li <[email protected]>
lriggs · Jan 8, 2024 · 9b18459 · 9b18459
1 parent a5db296
commit 9b18459
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 15 deletions.
diff --git a/docs/source/developers/java/building.rst b/docs/source/developers/java/building.rst
@@ -341,9 +341,6 @@ Arrow repository, and update the following settings:
   Settings > Build, Execution, Deployment > Compiler > Java Compiler and disable
   "Use '--release' option for cross-compilation (Java 9 and later)". Otherwise
   you will get an error like "package sun.misc does not exist".
-* You may want to disable error-prone entirely if it gives spurious
-  warnings (disable both error-prone profiles in the Maven tool window
-  and "Reload All Maven Projects").
 * If using IntelliJ's Maven integration to build, you may need to change
   ``<fork>`` to ``false`` in the pom.xml files due to an `IntelliJ bug
   <https://youtrack.jetbrains.com/issue/IDEA-278903>`__.

diff --git a/java/flight/flight-core/pom.xml b/java/flight/flight-core/pom.xml
@@ -98,11 +98,6 @@
       <groupId>io.grpc</groupId>
       <artifactId>grpc-api</artifactId>
     </dependency>
-    <dependency>
-      <groupId>io.grpc</groupId>
-      <artifactId>grpc-services</artifactId>
-      <scope>test</scope>
-    </dependency>
 
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>

diff --git a/java/flight/flight-sql/pom.xml b/java/flight/flight-sql/pom.xml
@@ -57,14 +57,26 @@
       <artifactId>arrow-jdbc</artifactId>
       <version>${project.version}</version>
     </dependency>
+    <dependency>
+      <groupId>io.grpc</groupId>
+      <artifactId>grpc-protobuf</artifactId>
+    </dependency>
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
     </dependency>
+    <dependency>
+      <groupId>io.grpc</groupId>
+      <artifactId>grpc-stub</artifactId>
+    </dependency>
     <dependency>
       <groupId>com.google.protobuf</groupId>
       <artifactId>protobuf-java</artifactId>
     </dependency>
+    <dependency>
+      <groupId>io.grpc</groupId>
+      <artifactId>grpc-api</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.apache.arrow</groupId>
       <artifactId>arrow-vector</artifactId>

diff --git a/java/pom.xml b/java/pom.xml
@@ -543,6 +543,11 @@
         <artifactId>flatbuffers-java</artifactId>
         <version>${dep.fbs.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${dep.guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>com.google.code.findbugs</groupId>
         <artifactId>jsr305</artifactId>
@@ -582,13 +587,6 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
-      <dependency>
-        <groupId>com.google.guava</groupId>
-        <artifactId>guava-bom</artifactId>
-        <version>${dep.guava-bom.version}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-bom</artifactId>