Databricks JDBC Driver 2.6.36 includes dependencies in pom.properties with vulnerabilities

Oleksandr — Wed, 20 Dec 2023 11:44:10 GMT

Starting from Databricks JDBC Driver 2.6.36 we've got Trivy security report with vulnerabilities from pom.properties.

2.6.36 adds org.apache.commons.commons-compress:1.20 and ch.qos.logback.logback-classic:1.2.3.
2.6.34 doesn't include such dependencies.
I'm wondering why we added it. I don't see any transitive dependencies and those jars are not in classpath but META-INF/pom.propetries are still present.

I don't think it's a vulnerability but such pom.propetries should be cleaned up or updated. Not sure why such changes were added to a path version. Also, I see that 2.6.35 is missing, so it might be some problems with the build process

Re: Databricks JDBC Driver 2.6.36 includes dependencies in pom.properties with vulnerabilities

Oleksandr — Wed, 20 Dec 2023 11:45:25 GMT

I didn't find where to open an issue (GitHub or Jira). Please, let me know if I need to report it somewhere else.

topic Re: Databricks JDBC Driver 2.6.36 includes dependencies in pom.properties with vulnerabilities in Get Started Discussions

Databricks JDBC Driver 2.6.36 includes dependencies in pom.properties with vulnerabilities

Re: Databricks JDBC Driver 2.6.36 includes dependencies in pom.properties with vulnerabilities