Bug: Fix Cassandra 4 build for snakeyaml >= 2.0
Status: Triage Needed
Priority: Normal
Created: 21/May/24 20:54

Hello,

We're trying to build a custom version of cassandra 4.1.4 that fixes some of the CVEs reported here:

[https://mvnrepository.com/artifact/org.apache.cassandra/cassandra-all/4.1.4]

So far the build passes with these upgrades on build.xml dependencies:
|*Name*|*Default version*|*Modified version*|
|slf4j|1.7.25|1.7.36|
|*{color:#00875a}snakeyaml{color}*|*{color:#00875a}1.26{color}*|*{color:#00875a}1.33{color}*|
|jackson-databind|2.13.2.2|2.17.0|
|netty|4.1.58.Final|4.1.109.Final|
|guava|27.0-jre|33.2.0-jre|
|commons-codec|1.9|1.17.0|

We're being asked to bump *snakeyaml* to >= {*}2.0{*}. This causes the build to fail with:
{code:java}
_build_java:
     [echo] Compiling for Java 8...
    [javac] Compiling 2138 source files to /Users/mrojas/git/cassandra/build/classes/main
    [javac] Note: Processing compiler hints annotations
    [javac] Note: Processing compiler hints annotations
    [javac] Note: Writing compiler command file at META-INF/hotspot_compiler
    [javac] Note: Done processing compiler hints annotations
    [javac] /Users/mrojas/git/cassandra/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java:226: error: constructor Composer in class Composer cannot be applied to given types;
    [javac]         constructor.setComposer(new Composer(null, null)
    [javac]                                 ^
    [javac]   required: Parser,Resolver,LoaderOptions
    [javac]   found: <null>,<null>
    [javac]   reason: actual and formal argument lists differ in length
    [javac] /Users/mrojas/git/cassandra/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java:279: error: incompatible types: Class<CAP#1> cannot be converted to ClassLoader
    [javac]             super(theRoot, classLoader);
    [javac]                   ^
    [javac]   where CAP#1 is a fresh type-variable:
    [javac]     CAP#1 extends Object from capture of ?
    [javac] /Users/mrojas/git/cassandra/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java:260: error: constructor Composer in class Composer cannot be applied to given types;
    [javac]         constructor.setComposer(new Composer(null, null)
    [javac]                                 ^
    [javac]   required: Parser,Resolver,LoaderOptions
    [javac]   found: <null>,<null>
    [javac]   reason: actual and formal argument lists differ in length
    [javac] /Users/mrojas/git/cassandra/src/java/org/apache/cassandra/tools/JMXTool.java:168: error: constructor Representer in class Representer cannot be applied to given types;
    [javac]                     Representer representer = new Representer();
    [javac]                                               ^
    [javac]   required: DumperOptions
    [javac]   found: no arguments
    [javac]   reason: actual and formal argument lists differ in length
    [javac] /Users/mrojas/git/cassandra/src/java/org/apache/cassandra/tools/JMXTool.java:398: error: no suitable constructor found for Constructor(no arguments)
    [javac]             {
    [javac]             ^
    [javac]     constructor Constructor.Constructor(LoaderOptions) is not applicable
    [javac]       (actual and formal argument lists differ in length)
    [javac]     constructor Constructor.Constructor(Class<? extends Object>,LoaderOptions) is not applicable
    [javac]       (actual and formal argument lists differ in length)
    [javac]     constructor Constructor.Constructor(TypeDescription,LoaderOptions) is not applicable
    [javac]       (actual and formal argument lists differ in length)
    [javac]     constructor Constructor.Constructor(TypeDescription,Collection<TypeDescription>,LoaderOptions) is not applicable
    [javac]       (actual and formal argument lists differ in length)
    [javac]     constructor Constructor.Constructor(String,LoaderOptions) is not applicable
    [javac]       (actual and formal argument lists differ in length)
    [javac] Note: Some input files use or override a deprecated API.
    [javac] Note: Recompile with -Xlint:deprecation for details.
    [javac] Note: Some input files use unchecked or unsafe operations.
    [javac] Note: Recompile with -Xlint:unchecked for details.
    [javac] Note: Some messages have been simplified; recompile with -Xdiags:verbose to get full output
    [javac] 5 errorsBUILD FAILED {code}
This is result of running:
{code:java}
➜  cassandra git:(99d9faeef5) ✗ ant realclean
➜  cassandra git:(99d9faeef5) ✗ ant artifacts {code}
Could you please fix build to work with snakeyaml >= 2.0?

Thanks