You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tinkerpop.apache.org by "smholsen (via GitHub)" <gi...@apache.org> on 2025/09/03 21:45:21 UTC
[PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
smholsen opened a new pull request, #3197:
URL: https://github.com/apache/tinkerpop/pull/3197
Please see https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj
<!--
Thanks for contributing! Reminders:
+ TARGET the earliest branch where you want the change
3.7-dev -> 3.7.5 (non-breaking only)
3.8-dev -> 3.8.0
master -> 4.0.0
+ Committers will MERGE the PR forward to newer versions
+ ADD entry to the CHANGELOG.asciidoc for the targeted version
Do not reference a JIRA number there
+ ADD JIRA number to title and link in description
+ PRs requires 3 +1s from committers OR
1 +1 and 7 day wait to merge.
+ MORE details: https://s.apache.org/rtnal
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "xiazcy (via GitHub)" <gi...@apache.org>.
xiazcy commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3268371034
> The last one I was not able to reproduce locally, and it seems to be flaky.
Thanks @smholsen, it does seem to be a flaky one. I'll rerun the action to make sure, but it should be safe to ignore that one for this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3293741555
Added https://github.com/apache/tinkerpop/pull/3197/commits/0a2f7d9b2d5dfea20c866120c9aa838f9ae3cde5 to address the flaky test, see: https://github.com/apache/tinkerpop/pull/3203#discussion_r2343644195.
@spmallette Could you please try to re-run the workflows now?
@andreachild (Tagging you for context)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3268246328
The last one I was not able to reproduce locally, and it seems to be flaky.
I see it has also failed recently on master: https://github.com/apache/tinkerpop/actions/runs/17505744500/job/49728960854.
Perhaps this one should be addressed separately?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "andreachild (via GitHub)" <gi...@apache.org>.
andreachild commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3267198059
@smholsen thanks for highlighting this security fix. If you have difficulty assessing the test failures feel free to let us know and we can help troubleshoot.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3278400587
@spmallette Any update on this? :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "spmallette (via GitHub)" <gi...@apache.org>.
spmallette commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3280232593
lets give folks a chance to review the other PR independently. interesting that its suddenly failing consistently after this netty upgrade. that begs some careful thought as to why and if it is an issue of concern or not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "andreachild (via GitHub)" <gi...@apache.org>.
andreachild commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3293747960
Hi @smholsen this branch needs to be rebased as there are merge conflicts. I can retrigger the workflow after that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3269139748
Added https://github.com/apache/tinkerpop/pull/3203 to address the flaky test.
Would be interesting to see if this one turns green in top of the flaky test fix.
(I don't have permissions to trigger workflows in this repo, so let me know if you want me to submit a separate PR with this change and the test fix in one).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "spmallette (via GitHub)" <gi...@apache.org>.
spmallette commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3279963420
thanks for looking deeper into the problems. i restarted the build to see if that flakey test would go away. not sure i know much about the semi-colon issue. i suppose that's the right way to handle that but i'd like some further input on that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3268224959
@spmallette @andreachild
The first issue (affecting the [gremlin-driver](https://github.com/apache/tinkerpop/actions/runs/17563632495/job/49886278997?pr=3197#logs) tests) was that the strings no longer contained the `;` delimiter, as it contained no additional args.
It would be great to have a second pair of eyes on this, as I am unsure whether it ever did, and so I am unsure why the `contains` check would actually expect the `;`?.
It looks to me to relate to this change in netty: https://github.com/netty/netty/commit/fa97ee929d81130d23e658a0758ca09e53be2cf3#diff-9da52528f865165da555eb36950d6da1742f56be76028f9538a25eb1fcf34dd2R45
The second issue (affecting [gremlin-server default](https://github.com/apache/tinkerpop/actions/runs/17563632495/job/49886117311?pr=3197#logs) and [gremlin-server unified](https://github.com/apache/tinkerpop/actions/runs/17563632495/job/49886117314?pr=3197#logs) ) was that the SelfSignedCert generation failed due to 1. missing the `bouncycastle` dependency, and 2. being on a jdk which doesn't provide sun.security.x509 package. The `bouncycastle` dependency is optional in netty, so that it is not included transitively.
It does not look to be a recent change that made this dependency optional in netty though, so I am not exactly sure why this only surfaced now.
[This is the entry path for picking the generator for the cert](https://github.com/netty/netty/blame/netty-4.1.125.Final/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L238), and I see there's been [recent changes to the fallback generator](https://github.com/netty/netty/blame/netty-4.1.125.Final/handler/src/main/java/io/netty/handler/ssl/util/OpenJdkSelfSignedCertGenerator.java) (used when `bouncycastle` is not available). I assume the fallback worked for us previously, but is now failing due to jdk mismatching.
I see there's one more in [gremlin-server default](https://github.com/apache/tinkerpop/actions/runs/17564718691/job/49890851822?pr=3197#logs), I'll have a look at this one as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "andreachild (via GitHub)" <gi...@apache.org>.
andreachild merged PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "spmallette (via GitHub)" <gi...@apache.org>.
spmallette commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3286924431
@smholsen thanks for the patience on this one. i think folks have been really busy with final 3.8.0 tasks and haven't had time for much else. i sense this will be merged in time for the next release event in the coming weeks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3264846070
@spmallette Anything I can do to expedite this one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3282081487
> lets give folks a chance to review the other PR independently. interesting that its suddenly failing consistently after this netty upgrade. that begs some careful thought as to why and if it is an issue of concern or not.
Sounds good! Let me know if there's anything I can do to streamline the process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "Cole-Greer (via GitHub)" <gi...@apache.org>.
Cole-Greer commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3320091007
Hi @smholsen, my apologies for delays in reviewing this PR. Thank you for driving both this upgrade and the fix to the flake test.
VOTE +1
(Reminder to the committer who merges this PR to revisit the NOTICE files for driver, server, and console)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "spmallette (via GitHub)" <gi...@apache.org>.
spmallette commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3265855906
@smholsen the tests seem to be legitimately failing as a result of this change. it might need some additional changes and i don't think any contributors have had a moment to look into it yet. if you could get the build passing (i assume it fails locally as well), then that would help move things along better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3280069258
@spmallette I see it failed again, would it be possible to try to run the same on https://github.com/apache/tinkerpop/pull/3203 to see if that addresses it? If so I could merge that into this PR if that is desirable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3250967562
## [Codecov](https://app.codecov.io/gh/apache/tinkerpop/pull/3197?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 74.24%. Comparing base ([`9b46b67`](https://app.codecov.io/gh/apache/tinkerpop/commit/9b46b6777d2fa250e41daacf2fa4554605aff53a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`52ed1cc`](https://app.codecov.io/gh/apache/tinkerpop/commit/52ed1cc1e3bcfee86849394a164d7e2d4db56b5f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 376 commits behind head on 3.7-dev.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 3.7-dev #3197 +/- ##
=============================================
- Coverage 76.14% 74.24% -1.91%
=============================================
Files 1084 28 -1056
Lines 65160 5917 -59243
Branches 7285 0 -7285
=============================================
- Hits 49616 4393 -45223
+ Misses 12839 1322 -11517
+ Partials 2705 202 -2503
```
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/tinkerpop/pull/3197?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "andreachild (via GitHub)" <gi...@apache.org>.
andreachild commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3300654627
thanks for fixing the flaky test!
VOTE +1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Upgrade netty to 4.1.125.Final (GHSA-3p8m-j85q-pgmj) [tinkerpop]
Posted by "smholsen (via GitHub)" <gi...@apache.org>.
smholsen commented on PR #3197:
URL: https://github.com/apache/tinkerpop/pull/3197#issuecomment-3290739137
> @smholsen thanks for the patience on this one. i think folks have been really busy with final 3.8.0 tasks and haven't had time for much else. i sense this will be merged in time for the next release event in the coming weeks.
Awesome, thanks! 🙌
Might be worth to bump it to [netty-4.1.127.Final](https://github.com/netty/netty/releases/tag/netty-4.1.127.Final) unless it introduces additional nuances that needs to be adressed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org