From bef21ceb14dfd4d3774c2b83d62c8dc0ded25f20 Mon Sep 17 00:00:00 2001
From: Viraj Jasani <vjasani@apache.org>
Date: Fri, 16 Apr 2021 12:36:01 +0530
Subject: [PATCH] HADOOP-17633. Bump json-smart to 2.4.2 and nimbus-jose-jwt to
 9.8 due to CVEs (#2895). Contributed by Viraj Jasani.

Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>
 Conflicts:
	LICENSE-binary
---
 hadoop-project/pom.xml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
index 1c6c9324132..d83626f2d14 100644
--- a/hadoop-project/pom.xml
+++ b/hadoop-project/pom.xml
@@ -151,6 +151,8 @@
     <hbase.two.version>2.0.0-beta-1</hbase.two.version>
     <junit.version>4.13.1</junit.version>
     <woodstox.version>5.3.0</woodstox.version>
+    <json-smart.version>2.4.2</json-smart.version>
+    <nimbus-jose-jwt.version>9.8.1</nimbus-jose-jwt.version>
   </properties>
 
   <dependencyManagement>
@@ -1251,7 +1253,7 @@
       <dependency>
           <groupId>com.nimbusds</groupId>
           <artifactId>nimbus-jose-jwt</artifactId>
-          <version>7.9</version>
+          <version>${nimbus-jose-jwt.version}</version>
           <scope>compile</scope>
           <exclusions>
           <exclusion>
@@ -1274,7 +1276,7 @@
           -->
         <groupId>net.minidev</groupId>
         <artifactId>json-smart</artifactId>
-        <version>2.3</version>
+        <version>${json-smart.version}</version>
       </dependency>
       <dependency>
         <groupId>org.skyscreamer</groupId>