{"action":"created","issue":{"url":"https://api.github.com/repos/apache/spark/issues/10198","labels_url":"https://api.github.com/repos/apache/spark/issues/10198/labels{/name}","comments_url":"https://api.github.com/repos/apache/spark/issues/10198/comments","events_url":"https://api.github.com/repos/apache/spark/issues/10198/events","html_url":"https://github.com/apache/spark/pull/10198","id":120983576,"number":10198,"title":"[SPARK-11652] [CORE] Remote code execution with InvokerTransformer","user":{"login":"srowen","id":822522,"avatar_url":"https://avatars.githubusercontent.com/u/822522?v=3","gravatar_id":"","url":"https://api.github.com/users/srowen","html_url":"https://github.com/srowen","followers_url":"https://api.github.com/users/srowen/followers","following_url":"https://api.github.com/users/srowen/following{/other_user}","gists_url":"https://api.github.com/users/srowen/gists{/gist_id}","starred_url":"https://api.github.com/users/srowen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/srowen/subscriptions","organizations_url":"https://api.github.com/users/srowen/orgs","repos_url":"https://api.github.com/users/srowen/repos","events_url":"https://api.github.com/users/srowen/events{/privacy}","received_events_url":"https://api.github.com/users/srowen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-12-08T10:57:53Z","updated_at":"2015-12-08T17:52:21Z","closed_at":"2015-12-08T14:36:35Z","pull_request":{"url":"https://api.github.com/repos/apache/spark/pulls/10198","html_url":"https://github.com/apache/spark/pull/10198","diff_url":"https://github.com/apache/spark/pull/10198.diff","patch_url":"https://github.com/apache/spark/pull/10198.patch"},"body":"Fix commons-collection group ID to commons-collections for version 3.x\r\n\r\nPatches earlier PR at https://github.com/apache/spark/pull/9731"},"comment":{"url":"https://api.github.com/repos/apache/spark/issues/comments/162960098","html_url":"https://github.com/apache/spark/pull/10198#issuecomment-162960098","issue_url":"https://api.github.com/repos/apache/spark/issues/10198","id":162960098,"user":{"login":"JoshRosen","id":50748,"avatar_url":"https://avatars.githubusercontent.com/u/50748?v=3","gravatar_id":"","url":"https://api.github.com/users/JoshRosen","html_url":"https://github.com/JoshRosen","followers_url":"https://api.github.com/users/JoshRosen/followers","following_url":"https://api.github.com/users/JoshRosen/following{/other_user}","gists_url":"https://api.github.com/users/JoshRosen/gists{/gist_id}","starred_url":"https://api.github.com/users/JoshRosen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JoshRosen/subscriptions","organizations_url":"https://api.github.com/users/JoshRosen/orgs","repos_url":"https://api.github.com/users/JoshRosen/repos","events_url":"https://api.github.com/users/JoshRosen/events{/privacy}","received_events_url":"https://api.github.com/users/JoshRosen/received_events","type":"User","site_admin":false},"created_at":"2015-12-08T17:52:21Z","updated_at":"2015-12-08T17:52:21Z","body":"Hey, quick Q.: how do we make sure that the bad version of the dependency (under a different org / artifact ID) doesn't get pulled in transitively and wind up taking precedence (e.g. in an assembly JAR)? Should we use the Maven Enforcer plugin or something to ban that older dependency?"}}