[PPP-6540] - Upgrade commons-configuration to commons-configuration2 - #3003
Open
rmansoor wants to merge 1 commit into
Open
[PPP-6540] - Upgrade commons-configuration to commons-configuration2#3003rmansoor wants to merge 1 commit into
rmansoor wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Upgrades the project away from Apache Commons Configuration 1.x to Commons Configuration 2.x (and related transitive-dependency CVE remediations), while adding bootstrap wiring and classloader-guarding to keep Hadoop shims and UI functionality working.
Changes:
- Replace
commons-configuration(1.x) usage/dependencies withorg.apache.commons:commons-configuration2across legacy + UI code and Maven modules. - Add a TCCL pin/restore guard when building
PropertiesConfigurationto avoid cross-classloader “Incompatible result object” failures, and add a regression test for it. - Add bootstrap plugin/SPI resources and tighten transitive dependency exposure via exclusions (commons-lang / commons-configuration 1.x).
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| services-bootstrap/src/main/resources/plugin.xml | Adds a bootstrap plugin descriptor to register lifecycle listeners. |
| services-bootstrap/src/main/resources/META-INF/services/org.pentaho.di.core.service.ServiceProviderInterface | Registers bootstrap-related service implementations via SPI. |
| services-bootstrap/pom.xml | Adds an exclusion to prevent pulling legacy commons-lang transitively from kettle-core. |
| pom.xml | Removes commons-configuration 1.x + related commons-lang 2.x compatibility wiring from root management. |
| legacy/src/test/java/org/pentaho/hadoop/PropertiesConfigurationPropertiesTest.java | Updates tests to import Commons Configuration 2.x types. |
| legacy/src/main/java/org/pentaho/hadoop/PropertiesConfigurationProperties.java | Migrates runtime implementation to Commons Configuration 2.x with reloading builder. |
| legacy/pom.xml | Swaps module dependency from commons-configuration (1.x) to commons-configuration2. |
| legacy-amazon/core/pom.xml | Swaps module dependency from commons-configuration (1.x) to commons-configuration2. |
| kettle-plugins/hdfs/core/pom.xml | Excludes commons-configuration (1.x) from a test dependency to avoid CVE exposure. |
| kettle-plugins/hbase-meta/pom.xml | Excludes commons-configuration (1.x) from a dependency to avoid CVE exposure. |
| kettle-plugins/hadoop-cluster/ui/src/test/java/.../HadoopClusterManagerTest.java | Updates to config2 builder usage and adds a TCCL isolation regression test. |
| kettle-plugins/hadoop-cluster/ui/src/main/java/.../HadoopClusterPopupMenuExtension.java | Defers service lookup until first use to allow bootstrap completion. |
| kettle-plugins/hadoop-cluster/ui/src/main/java/.../HadoopClusterManager.java | Uses config2 builders and adds TCCL pin/restore guard around configuration building. |
| kettle-plugins/hadoop-cluster/ui/pom.xml | Replaces commons-configuration (1.x) dependencies with commons-configuration2. |
| assemblies/pmr-libraries/pom.xml | Adds exclusions for legacy/vulnerable transitive deps and keeps commons-configuration2. |
| assemblies/pentaho-big-data-plugin/src/main/assembly/descriptors/plugin.xml | Removes 1.x commons-configuration includes from plugin assembly descriptor. |
| assemblies/pentaho-big-data-plugin/pom.xml | Replaces plugin assembly dependency on 1.x commons-configuration/commons-lang with commons-configuration2. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Comment on lines
129
to
135
| private Map<String, Object> toMap() { | ||
| Map<String, Object> result = new HashMap<>(); | ||
| Iterator<String> keys = propertiesConfiguration.getKeys(); | ||
| Iterator<String> keys = getPropertiesConfiguration().getKeys(); | ||
| while ( keys.hasNext() ) { | ||
| String next = keys.next(); | ||
| result.put( next, propertiesConfiguration.getProperty( next ) ); | ||
| result.put( next, getPropertiesConfiguration().getProperty( next ) ); | ||
| } |
Comment on lines
+112
to
+116
| <!-- commons-configuration 1.x removed (CVE); replaced by commons-configuration2. | ||
| commons-configuration2 is intentionally NOT bundled here - it is provided by | ||
| data-integration/lib. Bundling it would create a duplicate copy on this plugin's isolated | ||
| classloader and risk cross-classloader "Incompatible result object" failures with the shim. --> | ||
| <!-- commons-lang 2.6 is NOT included - using commons-lang3 3.18.0 instead (CVE-2025-48924 remediation) --> |
Comment on lines
+192
to
+198
| <exclusions> | ||
| <!-- Exclude vulnerable commons-configuration 1.x (CVE); replaced by commons-configuration2 --> | ||
| <exclusion> | ||
| <groupId>commons-configuration</groupId> | ||
| <artifactId>commons-configuration</artifactId> | ||
| </exclusion> | ||
| </exclusions> |
Comment on lines
+4
to
+10
| <lifecycle> | ||
| <lifecycle-listener class="org.pentaho.big.data.services.bootstrap.BigDataPluginLifecycleListener"/> | ||
| </lifecycle> | ||
|
|
||
| <lifecycle> | ||
| <lifecycle-listener class="org.pentaho.big.data.hadoop.bootstrap.HadoopConfigurationBootstrap"/> | ||
| </lifecycle> |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
pom.xml:95
- Several modules now declare a dependency on org.apache.commons:commons-configuration2 without a , but this parent POM no longer manages commons-configuration (and does not add commons-configuration2 to ). If the upstream parent doesn't provide it, Maven will fail with a missing version / inconsistent versions across modules. Consider adding a managed commons-configuration2 version here (optionally via a property) so all modules resolve consistently.
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.18.0</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-text</artifactId>
<version>1.11.0</version>
</dependency>
<dependency>
This comment has been minimized.
This comment has been minimized.
Collaborator
|
Note:Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system. |
Collaborator
✅ Build finished in 9m 4sBuild command: mvn clean verify -B -e -Daudit -Djs.no.sandbox👌 All tests passed! Tests run: 1117, Failures: 0, Skipped: 17 Test Results ℹ️ This is an automatic message |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.