{"action":"created","issue":{"url":"https://api.github.com/repos/apache/spark/issues/14379","repository_url":"https://api.github.com/repos/apache/spark","labels_url":"https://api.github.com/repos/apache/spark/issues/14379/labels{/name}","comments_url":"https://api.github.com/repos/apache/spark/issues/14379/comments","events_url":"https://api.github.com/repos/apache/spark/issues/14379/events","html_url":"https://github.com/apache/spark/pull/14379","id":167846378,"number":14379,"title":"[SPARK-16751] Upgrade Derby, remove from package","user":{"login":"a-roberts","id":12814972,"avatar_url":"https://avatars.githubusercontent.com/u/12814972?v=3","gravatar_id":"","url":"https://api.github.com/users/a-roberts","html_url":"https://github.com/a-roberts","followers_url":"https://api.github.com/users/a-roberts/followers","following_url":"https://api.github.com/users/a-roberts/following{/other_user}","gists_url":"https://api.github.com/users/a-roberts/gists{/gist_id}","starred_url":"https://api.github.com/users/a-roberts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a-roberts/subscriptions","organizations_url":"https://api.github.com/users/a-roberts/orgs","repos_url":"https://api.github.com/users/a-roberts/repos","events_url":"https://api.github.com/users/a-roberts/events{/privacy}","received_events_url":"https://api.github.com/users/a-roberts/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-07-27T12:53:56Z","updated_at":"2016-07-27T17:08:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/spark/pulls/14379","html_url":"https://github.com/apache/spark/pull/14379","diff_url":"https://github.com/apache/spark/pull/14379.diff","patch_url":"https://github.com/apache/spark/pull/14379.patch"},"body":"## What changes were proposed in this pull request?\r\n\r\nVersion of derby upgraded based on important security info at VersionEye. Test scope added so we don't include it in our final package anyway. NB: I think this should be backported to all previous releases as it is a security problem https://www.versioneye.com/java/org.apache.derby:derby/10.11.1.1\r\n\r\nThe CVE number is 2015-1832. I also suggest we add a SECURITY tag for JIRAs\r\n\r\n## How was this patch tested?\r\nExisting tests with the change making sure that we see no new failures. I checked derby 10.12.x and not derby 10.11.x is downloaded to our ~/.m2 folder.\r\n\r\nI then used dev/make-distribution.sh and checked the dist/jars folder for Spark 2.0: no derby jar is present.\r\n\r\nI don't know if this would also remove it from the assembly jar in our 1.x branches."},"comment":{"url":"https://api.github.com/repos/apache/spark/issues/comments/235653049","html_url":"https://github.com/apache/spark/pull/14379#issuecomment-235653049","issue_url":"https://api.github.com/repos/apache/spark/issues/14379","id":235653049,"user":{"login":"vanzin","id":1694083,"avatar_url":"https://avatars.githubusercontent.com/u/1694083?v=3","gravatar_id":"","url":"https://api.github.com/users/vanzin","html_url":"https://github.com/vanzin","followers_url":"https://api.github.com/users/vanzin/followers","following_url":"https://api.github.com/users/vanzin/following{/other_user}","gists_url":"https://api.github.com/users/vanzin/gists{/gist_id}","starred_url":"https://api.github.com/users/vanzin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vanzin/subscriptions","organizations_url":"https://api.github.com/users/vanzin/orgs","repos_url":"https://api.github.com/users/vanzin/repos","events_url":"https://api.github.com/users/vanzin/events{/privacy}","received_events_url":"https://api.github.com/users/vanzin/received_events","type":"User","site_admin":false},"created_at":"2016-07-27T17:08:43Z","updated_at":"2016-07-27T17:08:43Z","body":"I don't know what exact error you'd get, but you would almost certainly get some error. Removing the test scope (and updating the PR title) should be all that's needed here."}}
{"actor":{"display_login":"vanzin"}}