You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@bookkeeper.apache.org by "shoothzj (via GitHub)" <gi...@apache.org> on 2024/05/06 12:11:33 UTC
[PR] Bump grpc from 1.56.0 to 1.63.0 address CVE list [bookkeeper]
shoothzj opened a new pull request, #4344:
URL: https://github.com/apache/bookkeeper/pull/4344
CVE-2023-44487(7.5), CVE-2023-4785(7.5), CVE-2023-33953(7.5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2113906916
@lhotari please also take a look
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.64.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj merged PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "hangc0276 (via GitHub)" <gi...@apache.org>.
hangc0276 commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2100243758
We need to be careful to upgrade grpc versions. Pulsar also uses grpc and the version needs to be sync and compatible
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2114112003
@lhotari fixed, please take a look again. :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.64.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2114200116
@lhotari I aggree change the dest version to 1.64.0. updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2114011177
> @lhotari please also take a look
protobuf version should be upgraded at the same time to ensure that it's compatible with grpc. Pick the version that grpc uses.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2114125567
It looks like grpc 1.64.0 was released yesterday. Should we go directly to the latest release?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.64.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2114682082
@lhotari I found owasp check is broken, it doesn't trigger when I change the `pom.xml`. do you have any advice?
https://github.com/apache/bookkeeper/blob/c2e8037baa5ad2beaab29c519a5a54a893d00585/.github/workflows/bk-ci.yml#L482-L487
https://github.com/apache/bookkeeper/blob/c2e8037baa5ad2beaab29c519a5a54a893d00585/.github/changes-filter.yaml#L12-L16
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2100283162
> We need to be careful to upgrade grpc versions. Pulsar also uses grpc and the version needs to be sync and compatible
I agree. But bk should go first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2097197941
@dlg99 @eolivelli @hangc0276 @merlimat @nicoloboschi @StevenLuMT @wenbingshen @zhaijack PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump grpc from 1.56.0 to 1.63.0 to address CVE list [bookkeeper]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #4344:
URL: https://github.com/apache/bookkeeper/pull/4344#issuecomment-2114122814
> @lhotari fixed, please take a look again. :)
We could also migrate to use `protobuf-bom` in dependencyManagement.
```xml
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-bom</artifactId>
<version>${protobuf.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org