You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by xi...@apache.org on 2023/12/14 05:37:46 UTC
(pulsar) branch branch-2.10 updated (44f9797003c -> 2f00fb91d66)
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a change to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/pulsar.git
from 44f9797003c [fix] [broker] network package lost if enable haProxyProtocolEnabled (#21684)
new 10449326397 [fix][sec] Upgrade snappy-java to 1.1.10.5 (#21280)
new 5f282575401 [fix][sec] Bump avro version to 1.11.3 for CVE-2023-39410 (#21341)
new 969b0084bfa [fix][misc] Bump GRPC version to 1.55.3 to fix CVE (#21057)
new 0dd85457112 [improve][build] Upgrade Apache ZooKeeper to 3.9.1 (#20933)
new 2f00fb91d66 [fix][sec] Upgrade Netty to 4.1.100 to address CVE-2023-44487 (#21397)
The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
distribution/server/src/assemble/LICENSE.bin.txt | 84 ++++++------
pom.xml | 12 +-
.../SchemaCompatibilityCheckTest.java | 2 +-
.../client/impl/schema/ProtobufSchemaTest.java | 6 +-
.../org/apache/pulsar/metadata/TestZKServer.java | 151 ++++++++++-----------
.../bookkeeper-storage/pom.xml | 6 +
pulsar-sql/presto-distribution/LICENSE | 64 ++++-----
7 files changed, 161 insertions(+), 164 deletions(-)
(pulsar) 03/05: [fix][misc] Bump GRPC version to 1.55.3 to fix CVE (#21057)
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a commit to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 969b0084bfa06f4f67e4ab399312cf64b1f46715
Author: Qiang Zhao <ma...@apache.org>
AuthorDate: Tue Aug 29 19:15:03 2023 +0800
[fix][misc] Bump GRPC version to 1.55.3 to fix CVE (#21057)
(cherry picked from commit 6ff83b6f8ab34bcb9045a2c249c8b14608dd965d)
---
distribution/server/src/assemble/LICENSE.bin.txt | 36 ++++++++++++------------
pom.xml | 4 +--
pulsar-sql/presto-distribution/LICENSE | 20 ++++++-------
3 files changed, 30 insertions(+), 30 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index b901ab7ba37..346d12688fc 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -322,7 +322,7 @@ The Apache Software License, Version 2.0
- com.fasterxml.jackson.module-jackson-module-jsonSchema-2.14.2.jar
* Caffeine -- com.github.ben-manes.caffeine-caffeine-2.9.1.jar
* Conscrypt -- org.conscrypt-conscrypt-openjdk-uber-2.5.2.jar
- * Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-2.0.1.jar
+ * Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-2.9.0.jar
* Bitbucket -- org.bitbucket.b_c-jose4j-0.9.3.jar
* Gson
- com.google.code.gson-gson-2.8.9.jar
@@ -465,24 +465,24 @@ The Apache Software License, Version 2.0
- org.jetbrains.kotlin-kotlin-stdlib-jdk8-1.6.0.jar
- org.jetbrains-annotations-13.0.jar
* gRPC
- - io.grpc-grpc-all-1.45.1.jar
- - io.grpc-grpc-auth-1.45.1.jar
- - io.grpc-grpc-context-1.45.1.jar
- - io.grpc-grpc-core-1.45.1.jar
- - io.grpc-grpc-netty-1.45.1.jar
- - io.grpc-grpc-protobuf-1.45.1.jar
- - io.grpc-grpc-protobuf-lite-1.45.1.jar
- - io.grpc-grpc-stub-1.45.1.jar
- - io.grpc-grpc-alts-1.45.1.jar
- - io.grpc-grpc-api-1.45.1.jar
- - io.grpc-grpc-grpclb-1.45.1.jar
- - io.grpc-grpc-netty-shaded-1.45.1.jar
- - io.grpc-grpc-services-1.45.1.jar
- - io.grpc-grpc-xds-1.45.1.jar
- - io.grpc-grpc-rls-1.45.1.jar
+ - io.grpc-grpc-all-1.55.3.jar
+ - io.grpc-grpc-auth-1.55.3.jar
+ - io.grpc-grpc-context-1.55.3.jar
+ - io.grpc-grpc-core-1.55.3.jar
+ - io.grpc-grpc-netty-1.55.3.jar
+ - io.grpc-grpc-protobuf-1.55.3.jar
+ - io.grpc-grpc-protobuf-lite-1.55.3.jar
+ - io.grpc-grpc-stub-1.55.3.jar
+ - io.grpc-grpc-alts-1.55.3.jar
+ - io.grpc-grpc-api-1.55.3.jar
+ - io.grpc-grpc-grpclb-1.55.3.jar
+ - io.grpc-grpc-netty-shaded-1.55.3.jar
+ - io.grpc-grpc-services-1.55.3.jar
+ - io.grpc-grpc-xds-1.55.3.jar
+ - io.grpc-grpc-rls-1.55.3.jar
- com.google.auto.service-auto-service-annotations-1.0.jar
* Perfmark
- - io.perfmark-perfmark-api-0.19.0.jar
+ - io.perfmark-perfmark-api-0.26.0.jar
* OpenCensus
- io.opencensus-opencensus-api-0.28.0.jar
- io.opencensus-opencensus-contrib-http-util-0.28.0.jar
@@ -532,7 +532,7 @@ The Apache Software License, Version 2.0
- com.google.http-client-google-http-client-gson-1.41.0.jar
- com.google.http-client-google-http-client-1.41.0.jar
- com.google.auto.value-auto-value-annotations-1.9.jar
- - com.google.re2j-re2j-1.5.jar
+ - com.google.re2j-re2j-1.6.jar
* Jetcd
- io.etcd-jetcd-common-0.5.11.jar
- io.etcd-jetcd-core-0.5.11.jar
diff --git a/pom.xml b/pom.xml
index ea260e59184..84ec4cf0333 100644
--- a/pom.xml
+++ b/pom.xml
@@ -131,9 +131,9 @@ flexible messaging model and an intuitive client API.</description>
<typetools.version>0.5.0</typetools.version>
<protobuf3.version>3.19.6</protobuf3.version>
<protoc3.version>${protobuf3.version}</protoc3.version>
- <grpc.version>1.45.1</grpc.version>
+ <grpc.version>1.55.3</grpc.version>
<google-http-client.version>1.41.0</google-http-client.version>
- <perfmark.version>0.19.0</perfmark.version>
+ <perfmark.version>0.26.0</perfmark.version>
<protoc-gen-grpc-java.version>${grpc.version}</protoc-gen-grpc-java.version>
<gson.version>2.8.9</gson.version>
<system-lambda.version>1.2.1</system-lambda.version>
diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE
index e9ea054dc53..7b9e3ec1e1b 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -258,14 +258,14 @@ The Apache Software License, Version 2.0
- netty-transport-native-unix-common-4.1.93.Final-linux-x86_64.jar
- netty-codec-http2-4.1.93.Final.jar
* GRPC
- - grpc-api-1.45.1.jar
- - grpc-context-1.45.1.jar
- - grpc-core-1.45.1.jar
- - grpc-grpclb-1.45.1.jar
- - grpc-netty-1.45.1.jar
- - grpc-protobuf-1.45.1.jar
- - grpc-protobuf-lite-1.45.1.jar
- - grpc-stub-1.45.1.jar
+ - grpc-api-1.55.3.jar
+ - grpc-context-1.55.3.jar
+ - grpc-core-1.55.3.jar
+ - grpc-grpclb-1.55.3.jar
+ - grpc-netty-1.55.3.jar
+ - grpc-protobuf-1.55.3.jar
+ - grpc-protobuf-lite-1.55.3.jar
+ - grpc-stub-1.55.3.jar
* JEtcd
- jetcd-common-0.5.11.jar
- jetcd-core-0.5.11.jar
@@ -477,7 +477,7 @@ The Apache Software License, Version 2.0
* Swagger
- swagger-annotations-1.6.10.jar
* Perfmark
- - perfmark-api-0.19.0.jar
+ - perfmark-api-0.26.0.jar
* Annotations
- auto-service-annotations-1.0.jar
@@ -485,7 +485,7 @@ Protocol Buffers License
* Protocol Buffers
- protobuf-java-3.19.6.jar
- protobuf-java-util-3.19.6.jar
- - proto-google-common-protos-2.0.1.jar
+ - proto-google-common-protos-2.9.0.jar
BSD 3-clause "New" or "Revised" License
* RE2J TD -- re2j-td-1.4.jar
(pulsar) 04/05: [improve][build] Upgrade Apache ZooKeeper to 3.9.1 (#20933)
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a commit to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 0dd85457112d91e7780a96f636bc76b5e7c340ab
Author: Enrico Olivelli <eo...@apache.org>
AuthorDate: Wed Nov 29 01:55:43 2023 +0100
[improve][build] Upgrade Apache ZooKeeper to 3.9.1 (#20933)
Co-authored-by: Lari Hotari <lh...@apache.org>
Co-authored-by: xiangying <19...@qq.com>
Co-authored-by: Jiwe Guo <te...@apache.org>
(cherry picked from commit 5572c38cab38961b6cc3be9f99a3d39e3ae0ef2a)
---
distribution/server/src/assemble/LICENSE.bin.txt | 6 +-
pom.xml | 2 +-
.../org/apache/pulsar/metadata/TestZKServer.java | 151 ++++++++++-----------
.../bookkeeper-storage/pom.xml | 6 +
pulsar-sql/presto-distribution/LICENSE | 4 +-
5 files changed, 83 insertions(+), 86 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 346d12688fc..e05b1c723d9 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -522,9 +522,9 @@ The Apache Software License, Version 2.0
- io.vertx-vertx-web-3.9.8.jar
- io.vertx-vertx-web-common-3.9.8.jar
* Apache ZooKeeper
- - org.apache.zookeeper-zookeeper-3.6.4.jar
- - org.apache.zookeeper-zookeeper-jute-3.6.4.jar
- - org.apache.zookeeper-zookeeper-prometheus-metrics-3.6.4.jar
+ - org.apache.zookeeper-zookeeper-3.9.1.jar
+ - org.apache.zookeeper-zookeeper-jute-3.9.1.jar
+ - org.apache.zookeeper-zookeeper-prometheus-metrics-3.9.1.jar
* Snappy Java
- org.xerial.snappy-snappy-java-1.1.10.5.jar
* Google HTTP Client
diff --git a/pom.xml b/pom.xml
index 84ec4cf0333..9274bda3726 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,7 +105,7 @@ flexible messaging model and an intuitive client API.</description>
<commons-compress.version>1.21</commons-compress.version>
<bookkeeper.version>4.14.8</bookkeeper.version>
- <zookeeper.version>3.6.4</zookeeper.version>
+ <zookeeper.version>3.9.1</zookeeper.version>
<commons-cli.version>1.5.0</commons-cli.version>
<snappy.version>1.1.10.5</snappy.version> <!-- ZooKeeper server -->
<dropwizardmetrics.version>3.2.5</dropwizardmetrics.version> <!-- ZooKeeper server -->
diff --git a/pulsar-metadata/src/test/java/org/apache/pulsar/metadata/TestZKServer.java b/pulsar-metadata/src/test/java/org/apache/pulsar/metadata/TestZKServer.java
index ebe48cbff94..25195a61288 100644
--- a/pulsar-metadata/src/test/java/org/apache/pulsar/metadata/TestZKServer.java
+++ b/pulsar-metadata/src/test/java/org/apache/pulsar/metadata/TestZKServer.java
@@ -19,39 +19,33 @@
package org.apache.pulsar.metadata;
import static org.testng.Assert.assertTrue;
-
import java.io.BufferedReader;
import java.io.File;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
-import java.net.InetSocketAddress;
+import java.lang.reflect.Field;
import java.net.Socket;
-
-import java.nio.charset.StandardCharsets;
-
+import java.util.Properties;
+import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
-
import org.apache.commons.io.FileUtils;
-import org.apache.zookeeper.KeeperException;
import org.apache.zookeeper.server.ContainerManager;
-import org.apache.zookeeper.server.NIOServerCnxnFactory;
-import org.apache.zookeeper.server.Request;
-import org.apache.zookeeper.server.RequestProcessor;
import org.apache.zookeeper.server.ServerCnxnFactory;
-import org.apache.zookeeper.server.SessionTracker;
import org.apache.zookeeper.server.ZooKeeperServer;
+import org.apache.zookeeper.server.ZooKeeperServerMain;
+import org.apache.zookeeper.server.embedded.ExitHandler;
+import org.apache.zookeeper.server.embedded.ZooKeeperServerEmbedded;
import org.assertj.core.util.Files;
@Slf4j
public class TestZKServer implements AutoCloseable {
+
public static final int TICK_TIME = 1000;
- protected ZooKeeperServer zks;
- private final File zkDataDir;
- private ServerCnxnFactory serverFactory;
- private ContainerManager containerManager;
- private int zkPort = 0;
+ private final File zkDataDir;
+ private int zkPort; // initially this is zero
+ private ZooKeeperServerEmbedded zooKeeperServerEmbedded;
public TestZKServer() throws Exception {
this.zkDataDir = Files.newTemporaryFolder();
@@ -64,86 +58,86 @@ public class TestZKServer implements AutoCloseable {
}
public void start() throws Exception {
- this.zks = new ZooKeeperServer(zkDataDir, zkDataDir, TICK_TIME);
- this.zks.setMaxSessionTimeout(300_000);
- this.serverFactory = new NIOServerCnxnFactory();
- this.serverFactory.configure(new InetSocketAddress(zkPort), 1000);
- this.serverFactory.startup(zks, true);
-
- this.zkPort = serverFactory.getLocalPort();
- log.info("Started test ZK server on port {}", zkPort);
+ final Properties configZookeeper = new Properties();
+ configZookeeper.put("clientPort", zkPort + "");
+ configZookeeper.put("host", "127.0.0.1");
+ configZookeeper.put("ticktime", TICK_TIME + "");
+ zooKeeperServerEmbedded = ZooKeeperServerEmbedded
+ .builder()
+ .baseDir(zkDataDir.toPath())
+ .configuration(configZookeeper)
+ .exitHandler(ExitHandler.LOG_ONLY)
+ .build();
+
+ zooKeeperServerEmbedded.start(60_000);
+ log.info("Started test ZK server on at {}", zooKeeperServerEmbedded.getConnectionString());
+
+ ZooKeeperServerMain zooKeeperServerMain = getZooKeeperServerMain(zooKeeperServerEmbedded);
+ ServerCnxnFactory serverCnxnFactory = getServerCnxnFactory(zooKeeperServerMain);
+ // save the port, in order to allow restarting on the same port
+ zkPort = serverCnxnFactory.getLocalPort();
boolean zkServerReady = waitForServerUp(this.getConnectionString(), 30_000);
assertTrue(zkServerReady);
+ }
- this.containerManager = new ContainerManager(zks.getZKDatabase(), new RequestProcessor() {
- @Override
- public void processRequest(Request request) throws RequestProcessorException {
- String path = StandardCharsets.UTF_8.decode(request.request).toString();
- try {
- zks.getZKDatabase().getDataTree().deleteNode(path, -1);
- } catch (KeeperException.NoNodeException e) {
- // Ok
- }
- }
+ @SneakyThrows
+ private static ZooKeeperServerMain getZooKeeperServerMain(ZooKeeperServerEmbedded zooKeeperServerEmbedded) {
+ ZooKeeperServerMain zooKeeperServerMain = readField(zooKeeperServerEmbedded.getClass(),
+ "mainsingle", zooKeeperServerEmbedded);
+ return zooKeeperServerMain;
+ }
- @Override
- public void shutdown() {
+ @SneakyThrows
+ private static ContainerManager getContainerManager(ZooKeeperServerMain zooKeeperServerMain) {
+ ContainerManager containerManager = readField(ZooKeeperServerMain.class, "containerManager", zooKeeperServerMain);
+ return containerManager;
+ }
- }
- }, 10, 10000, 0L);
+ @SneakyThrows
+ private static ZooKeeperServer getZooKeeperServer(ZooKeeperServerMain zooKeeperServerMain) {
+ ServerCnxnFactory serverCnxnFactory = getServerCnxnFactory(zooKeeperServerMain);
+ ZooKeeperServer zkServer = readField(ServerCnxnFactory.class, "zkServer", serverCnxnFactory);
+ return zkServer;
+ }
+
+ @SneakyThrows
+ private static <T> T readField(Class clazz, String field, Object object) {
+ Field declaredField = clazz.getDeclaredField(field);
+ boolean accessible = declaredField.isAccessible();
+ if (!accessible) {
+ declaredField.setAccessible(true);
+ }
+ try {
+ return (T) declaredField.get(object);
+ } finally {
+ declaredField.setAccessible(accessible);
+ }
+ }
+
+ private static ServerCnxnFactory getServerCnxnFactory(ZooKeeperServerMain zooKeeperServerMain) throws Exception {
+ ServerCnxnFactory serverCnxnFactory = readField(ZooKeeperServerMain.class, "cnxnFactory", zooKeeperServerMain);
+ return serverCnxnFactory;
}
public void checkContainers() throws Exception {
// Make sure the container nodes are actually deleted
Thread.sleep(1000);
+ ContainerManager containerManager = getContainerManager(getZooKeeperServerMain(zooKeeperServerEmbedded));
containerManager.checkContainers();
}
public void stop() throws Exception {
- if (containerManager != null) {
- containerManager.stop();
- containerManager = null;
- }
-
- if (serverFactory != null) {
- serverFactory.shutdown();
- serverFactory = null;
- }
-
- if (zks != null) {
- SessionTracker sessionTracker = zks.getSessionTracker();
- zks.shutdown();
- zks.getZKDatabase().close();
- if (sessionTracker instanceof Thread) {
- Thread sessionTrackerThread = (Thread) sessionTracker;
- sessionTrackerThread.interrupt();
- sessionTrackerThread.join();
- }
- zks = null;
+ if (zooKeeperServerEmbedded != null) {
+ zooKeeperServerEmbedded.close();
}
-
log.info("Stopped test ZK server");
}
public void expireSession(long sessionId) {
- zks.expire(new SessionTracker.Session() {
- @Override
- public long getSessionId() {
- return sessionId;
- }
-
- @Override
- public int getTimeout() {
- return 10_000;
- }
-
- @Override
- public boolean isClosing() {
- return false;
- }
- });
+ getZooKeeperServer(getZooKeeperServerMain(zooKeeperServerEmbedded))
+ .expire(sessionId);
}
@Override
@@ -152,12 +146,9 @@ public class TestZKServer implements AutoCloseable {
FileUtils.deleteDirectory(zkDataDir);
}
- public int getPort() {
- return zkPort;
- }
-
+ @SneakyThrows
public String getConnectionString() {
- return "127.0.0.1:" + getPort();
+ return zooKeeperServerEmbedded.getConnectionString();
}
public static boolean waitForServerUp(String hp, long timeout) {
diff --git a/pulsar-package-management/bookkeeper-storage/pom.xml b/pulsar-package-management/bookkeeper-storage/pom.xml
index 4665eb81697..893490d8b30 100644
--- a/pulsar-package-management/bookkeeper-storage/pom.xml
+++ b/pulsar-package-management/bookkeeper-storage/pom.xml
@@ -57,6 +57,12 @@
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.hamcrest</groupId>
+ <artifactId>hamcrest</artifactId>
+ <scope>test</scope>
+ </dependency>
+
<!-- zookeeper server -->
<dependency>
<groupId>io.dropwizard.metrics</groupId>
diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE
index 7b9e3ec1e1b..cf0552fe057 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -470,8 +470,8 @@ The Apache Software License, Version 2.0
- memory-0.8.3.jar
- sketches-core-0.8.3.jar
* Apache Zookeeper
- - zookeeper-3.6.4.jar
- - zookeeper-jute-3.6.4.jar
+ - zookeeper-3.9.1.jar
+ - zookeeper-jute-3.9.1.jar
* Apache Yetus Audience Annotations
- audience-annotations-0.13.0.jar
* Swagger
(pulsar) 01/05: [fix][sec] Upgrade snappy-java to 1.1.10.5 (#21280)
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a commit to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 1044932639790772211147b19ea3cb876ffd523b
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Tue Oct 3 14:06:05 2023 +0300
[fix][sec] Upgrade snappy-java to 1.1.10.5 (#21280)
(cherry picked from commit 643428bb295ee4781e86aa2c72e5ad5d61b98870)
---
distribution/server/src/assemble/LICENSE.bin.txt | 2 +-
pom.xml | 2 +-
pulsar-sql/presto-distribution/LICENSE | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 10bd07b505b..ef144925b4e 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -526,7 +526,7 @@ The Apache Software License, Version 2.0
- org.apache.zookeeper-zookeeper-jute-3.6.4.jar
- org.apache.zookeeper-zookeeper-prometheus-metrics-3.6.4.jar
* Snappy Java
- - org.xerial.snappy-snappy-java-1.1.10.1.jar
+ - org.xerial.snappy-snappy-java-1.1.10.5.jar
* Google HTTP Client
- com.google.http-client-google-http-client-jackson2-1.41.0.jar
- com.google.http-client-google-http-client-gson-1.41.0.jar
diff --git a/pom.xml b/pom.xml
index 4902bb4d276..1721307d992 100644
--- a/pom.xml
+++ b/pom.xml
@@ -107,7 +107,7 @@ flexible messaging model and an intuitive client API.</description>
<bookkeeper.version>4.14.8</bookkeeper.version>
<zookeeper.version>3.6.4</zookeeper.version>
<commons-cli.version>1.5.0</commons-cli.version>
- <snappy.version>1.1.10.1</snappy.version> <!-- ZooKeeper server -->
+ <snappy.version>1.1.10.5</snappy.version> <!-- ZooKeeper server -->
<dropwizardmetrics.version>3.2.5</dropwizardmetrics.version> <!-- ZooKeeper server -->
<curator.version>5.1.0</curator.version>
<netty.version>4.1.93.Final</netty.version>
diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE
index edfaadd5415..5250e6176f4 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -457,7 +457,7 @@ The Apache Software License, Version 2.0
* GSON
- gson-2.8.9.jar
* Snappy
- - snappy-java-1.1.10.1.jar
+ - snappy-java-1.1.10.5.jar
* Jackson
- jackson-module-parameter-names-2.14.2.jar
* Java Assist
(pulsar) 02/05: [fix][sec] Bump avro version to 1.11.3 for CVE-2023-39410 (#21341)
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a commit to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 5f282575401948fedd18e8438627b806112736b0
Author: tison <wa...@gmail.com>
AuthorDate: Tue Oct 17 09:38:02 2023 +0800
[fix][sec] Bump avro version to 1.11.3 for CVE-2023-39410 (#21341)
Signed-off-by: tison <wa...@gmail.com>
(cherry picked from commit f5222d6b1f64d14029f8fef3e0108cf74ffefded)
---
distribution/server/src/assemble/LICENSE.bin.txt | 4 ++--
pom.xml | 2 +-
.../pulsar/schema/compatibility/SchemaCompatibilityCheckTest.java | 2 +-
.../org/apache/pulsar/client/impl/schema/ProtobufSchemaTest.java | 6 +++---
pulsar-sql/presto-distribution/LICENSE | 4 ++--
5 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index ef144925b4e..b901ab7ba37 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -491,8 +491,8 @@ The Apache Software License, Version 2.0
- net.jodah-typetools-0.5.0.jar
- net.jodah-failsafe-2.4.4.jar
* Apache Avro
- - org.apache.avro-avro-1.10.2.jar
- - org.apache.avro-avro-protobuf-1.10.2.jar
+ - org.apache.avro-avro-1.11.3.jar
+ - org.apache.avro-avro-protobuf-1.11.3.jar
* Apache Curator
- org.apache.curator-curator-client-5.1.0.jar
- org.apache.curator-curator-framework-5.1.0.jar
diff --git a/pom.xml b/pom.xml
index 1721307d992..ea260e59184 100644
--- a/pom.xml
+++ b/pom.xml
@@ -144,7 +144,7 @@ flexible messaging model and an intuitive client API.</description>
<kafka-client.version>2.7.2</kafka-client.version>
<rabbitmq-client.version>5.1.1</rabbitmq-client.version>
<aws-sdk.version>1.12.262</aws-sdk.version>
- <avro.version>1.10.2</avro.version>
+ <avro.version>1.11.3</avro.version>
<joda.version>2.10.5</joda.version>
<jclouds.version>2.5.0</jclouds.version>
<guice.version>5.1.0</guice.version>
diff --git a/pulsar-broker/src/test/java/org/apache/pulsar/schema/compatibility/SchemaCompatibilityCheckTest.java b/pulsar-broker/src/test/java/org/apache/pulsar/schema/compatibility/SchemaCompatibilityCheckTest.java
index 5e0beed27dc..6493ec3026b 100644
--- a/pulsar-broker/src/test/java/org/apache/pulsar/schema/compatibility/SchemaCompatibilityCheckTest.java
+++ b/pulsar-broker/src/test/java/org/apache/pulsar/schema/compatibility/SchemaCompatibilityCheckTest.java
@@ -407,7 +407,7 @@ public class SchemaCompatibilityCheckTest extends MockedPulsarServiceBaseTest {
assertEquals(admin.namespaces().getSchemaCompatibilityStrategy(namespaceName.toString()),
SchemaCompatibilityStrategy.UNDEFINED);
byte[] changeSchemaBytes = (new String(Schema.AVRO(Schemas.PersonOne.class)
- .getSchemaInfo().getSchema(), UTF_8) + "/n /n /n").getBytes();
+ .getSchemaInfo().getSchema(), UTF_8) + "\n \n \n").getBytes();
SchemaInfo schemaInfo = SchemaInfo.builder().type(SchemaType.AVRO).schema(changeSchemaBytes).build();
admin.schemas().createSchema(fqtn, schemaInfo);
diff --git a/pulsar-client/src/test/java/org/apache/pulsar/client/impl/schema/ProtobufSchemaTest.java b/pulsar-client/src/test/java/org/apache/pulsar/client/impl/schema/ProtobufSchemaTest.java
index 7f3eed12f31..06a35234ee9 100644
--- a/pulsar-client/src/test/java/org/apache/pulsar/client/impl/schema/ProtobufSchemaTest.java
+++ b/pulsar-client/src/test/java/org/apache/pulsar/client/impl/schema/ProtobufSchemaTest.java
@@ -41,20 +41,20 @@ public class ProtobufSchemaTest {
"\"namespace\":\"org.apache.pulsar.client.schema.proto.Test\"," +
"\"fields\":[{\"name\":\"stringField\",\"type\":{\"type\":\"string\"," +
"\"avro.java.string\":\"String\"},\"default\":\"\"},{\"name\":\"doubleField\"," +
- "\"type\":\"double\",\"default\":0},{\"name\":\"intField\",\"type\":\"int\"," +
+ "\"type\":\"double\",\"default\":0.0},{\"name\":\"intField\",\"type\":\"int\"," +
"\"default\":0},{\"name\":\"testEnum\",\"type\":{\"type\":\"enum\"," +
"\"name\":\"TestEnum\",\"symbols\":[\"SHARED\",\"FAILOVER\"]}," +
"\"default\":\"SHARED\"},{\"name\":\"nestedField\"," +
"\"type\":[\"null\",{\"type\":\"record\",\"name\":\"SubMessage\"," +
"\"fields\":[{\"name\":\"foo\",\"type\":{\"type\":\"string\"," +
"\"avro.java.string\":\"String\"},\"default\":\"\"}" +
- ",{\"name\":\"bar\",\"type\":\"double\",\"default\":0}]}]" +
+ ",{\"name\":\"bar\",\"type\":\"double\",\"default\":0.0}]}]" +
",\"default\":null},{\"name\":\"repeatedField\",\"type\":{\"type\":\"array\"" +
",\"items\":{\"type\":\"string\",\"avro.java.string\":\"String\"}},\"default\":[]}" +
",{\"name\":\"externalMessage\",\"type\":[\"null\",{\"type\":\"record\"" +
",\"name\":\"ExternalMessage\",\"namespace\":\"org.apache.pulsar.client.schema.proto.ExternalTest\"" +
",\"fields\":[{\"name\":\"stringField\",\"type\":{\"type\":\"string\",\"avro.java.string\":\"String\"}," +
- "\"default\":\"\"},{\"name\":\"doubleField\",\"type\":\"double\",\"default\":0}]}],\"default\":null}]}";
+ "\"default\":\"\"},{\"name\":\"doubleField\",\"type\":\"double\",\"default\":0.0}]}],\"default\":null}]}";
private static final String EXPECTED_PARSING_INFO = "{\"__alwaysAllowNull\":\"true\",\"__jsr310ConversionEnabled\":\"false\"," +
"\"__PARSING_INFO__\":\"[{\\\"number\\\":1,\\\"name\\\":\\\"stringField\\\",\\\"type\\\":\\\"STRING\\\"," +
diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE
index 5250e6176f4..e9ea054dc53 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -381,8 +381,8 @@ The Apache Software License, Version 2.0
* Apache XBean :: Reflect
- xbean-reflect-3.4.jar
* Avro
- - avro-1.10.2.jar
- - avro-protobuf-1.10.2.jar
+ - avro-1.11.3.jar
+ - avro-protobuf-1.11.3.jar
* Caffeine
- caffeine-2.9.1.jar
* Javax
(pulsar) 05/05: [fix][sec] Upgrade Netty to 4.1.100 to address CVE-2023-44487 (#21397)
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiangying pushed a commit to branch branch-2.10
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 2f00fb91d66b265efbaa002d3d995806c04f70ad
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Thu Oct 19 16:05:09 2023 +0300
[fix][sec] Upgrade Netty to 4.1.100 to address CVE-2023-44487 (#21397)
(cherry picked from commit aae6c716b6f7b32c96484b9004b62359e27f158e)
---
distribution/server/src/assemble/LICENSE.bin.txt | 36 ++++++++++++------------
pom.xml | 2 +-
pulsar-sql/presto-distribution/LICENSE | 34 +++++++++++-----------
3 files changed, 36 insertions(+), 36 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index e05b1c723d9..29b089b123b 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -352,24 +352,24 @@ The Apache Software License, Version 2.0
- org.apache.commons-commons-compress-1.21.jar
- org.apache.commons-commons-lang3-3.11.jar
* Netty
- - io.netty-netty-buffer-4.1.93.Final.jar
- - io.netty-netty-codec-4.1.93.Final.jar
- - io.netty-netty-codec-dns-4.1.93.Final.jar
- - io.netty-netty-codec-http-4.1.93.Final.jar
- - io.netty-netty-codec-http2-4.1.93.Final.jar
- - io.netty-netty-codec-socks-4.1.93.Final.jar
- - io.netty-netty-codec-haproxy-4.1.93.Final.jar
- - io.netty-netty-common-4.1.93.Final.jar
- - io.netty-netty-handler-4.1.93.Final.jar
- - io.netty-netty-handler-proxy-4.1.93.Final.jar
- - io.netty-netty-resolver-4.1.93.Final.jar
- - io.netty-netty-resolver-dns-4.1.93.Final.jar
- - io.netty-netty-transport-4.1.93.Final.jar
- - io.netty-netty-transport-classes-epoll-4.1.93.Final.jar
- - io.netty-netty-transport-native-epoll-4.1.93.Final-linux-x86_64.jar
- - io.netty-netty-transport-native-epoll-4.1.93.Final.jar
- - io.netty-netty-transport-native-unix-common-4.1.93.Final.jar
- - io.netty-netty-transport-native-unix-common-4.1.93.Final-linux-x86_64.jar
+ - io.netty-netty-buffer-4.1.100.Final.jar
+ - io.netty-netty-codec-4.1.100.Final.jar
+ - io.netty-netty-codec-dns-4.1.100.Final.jar
+ - io.netty-netty-codec-http-4.1.100.Final.jar
+ - io.netty-netty-codec-http2-4.1.100.Final.jar
+ - io.netty-netty-codec-socks-4.1.100.Final.jar
+ - io.netty-netty-codec-haproxy-4.1.100.Final.jar
+ - io.netty-netty-common-4.1.100.Final.jar
+ - io.netty-netty-handler-4.1.100.Final.jar
+ - io.netty-netty-handler-proxy-4.1.100.Final.jar
+ - io.netty-netty-resolver-4.1.100.Final.jar
+ - io.netty-netty-resolver-dns-4.1.100.Final.jar
+ - io.netty-netty-transport-4.1.100.Final.jar
+ - io.netty-netty-transport-classes-epoll-4.1.100.Final.jar
+ - io.netty-netty-transport-native-epoll-4.1.100.Final-linux-x86_64.jar
+ - io.netty-netty-transport-native-epoll-4.1.100.Final.jar
+ - io.netty-netty-transport-native-unix-common-4.1.100.Final.jar
+ - io.netty-netty-transport-native-unix-common-4.1.100.Final-linux-x86_64.jar
- io.netty-netty-tcnative-boringssl-static-2.0.61.Final.jar
- io.netty-netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar
- io.netty-netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar
diff --git a/pom.xml b/pom.xml
index 9274bda3726..63214b55f52 100644
--- a/pom.xml
+++ b/pom.xml
@@ -110,7 +110,7 @@ flexible messaging model and an intuitive client API.</description>
<snappy.version>1.1.10.5</snappy.version> <!-- ZooKeeper server -->
<dropwizardmetrics.version>3.2.5</dropwizardmetrics.version> <!-- ZooKeeper server -->
<curator.version>5.1.0</curator.version>
- <netty.version>4.1.93.Final</netty.version>
+ <netty.version>4.1.100.Final</netty.version>
<jetty.version>9.4.51.v20230217</jetty.version>
<conscrypt.version>2.5.2</conscrypt.version>
<jersey.version>2.34</jersey.version>
diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE
index cf0552fe057..d66d84af919 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -232,18 +232,18 @@ The Apache Software License, Version 2.0
- commons-lang3-3.11.jar
* Netty
- netty-3.10.6.Final.jar
- - netty-buffer-4.1.93.Final.jar
- - netty-codec-4.1.93.Final.jar
- - netty-codec-dns-4.1.93.Final.jar
- - netty-codec-http-4.1.93.Final.jar
- - netty-codec-haproxy-4.1.93.Final.jar
- - netty-codec-socks-4.1.93.Final.jar
- - netty-handler-proxy-4.1.93.Final.jar
- - netty-common-4.1.93.Final.jar
- - netty-handler-4.1.93.Final.jar
+ - netty-buffer-4.1.100.Final.jar
+ - netty-codec-4.1.100.Final.jar
+ - netty-codec-dns-4.1.100.Final.jar
+ - netty-codec-http-4.1.100.Final.jar
+ - netty-codec-haproxy-4.1.100.Final.jar
+ - netty-codec-socks-4.1.100.Final.jar
+ - netty-handler-proxy-4.1.100.Final.jar
+ - netty-common-4.1.100.Final.jar
+ - netty-handler-4.1.100.Final.jar
- netty-reactive-streams-2.0.6.jar
- - netty-resolver-4.1.93.Final.jar
- - netty-resolver-dns-4.1.93.Final.jar
+ - netty-resolver-4.1.100.Final.jar
+ - netty-resolver-dns-4.1.100.Final.jar
- netty-tcnative-boringssl-static-2.0.61.Final.jar
- netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar
- netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar
@@ -251,12 +251,12 @@ The Apache Software License, Version 2.0
- netty-tcnative-boringssl-static-2.0.61.Final-osx-x86_64.jar
- netty-tcnative-boringssl-static-2.0.61.Final-windows-x86_64.jar
- netty-tcnative-classes-2.0.61.Final.jar
- - netty-transport-4.1.93.Final.jar
- - netty-transport-classes-epoll-4.1.93.Final.jar
- - netty-transport-native-epoll-4.1.93.Final-linux-x86_64.jar
- - netty-transport-native-unix-common-4.1.93.Final.jar
- - netty-transport-native-unix-common-4.1.93.Final-linux-x86_64.jar
- - netty-codec-http2-4.1.93.Final.jar
+ - netty-transport-4.1.100.Final.jar
+ - netty-transport-classes-epoll-4.1.100.Final.jar
+ - netty-transport-native-epoll-4.1.100.Final-linux-x86_64.jar
+ - netty-transport-native-unix-common-4.1.100.Final.jar
+ - netty-transport-native-unix-common-4.1.100.Final-linux-x86_64.jar
+ - netty-codec-http2-4.1.100.Final.jar
* GRPC
- grpc-api-1.55.3.jar
- grpc-context-1.55.3.jar