You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by mm...@apache.org on 2025/10/27 21:28:31 UTC
(pulsar) branch branch-4.0 updated (9ebf5fa6701 -> bf71d4d55ee)
This is an automated email from the ASF dual-hosted git repository.
mmerli pushed a change to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
from 9ebf5fa6701 [fix][test] Stabilize SequenceIdWithErrorTest by fencing after first publish to avoid empty-ledger deletion and send timeout (#24861)
new a59c490662c [fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (#24889)
new bf71d4d55ee [fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (#24897)
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
distribution/server/src/assemble/LICENSE.bin.txt | 48 ++++++++++++------------
distribution/shell/src/assemble/LICENSE.bin.txt | 16 ++++----
pom.xml | 4 +-
3 files changed, 34 insertions(+), 34 deletions(-)
(pulsar) 02/02: [fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (#24897)
Posted by mm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mmerli pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit bf71d4d55eee6ff0eab7036f616291bcf3d604ee
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Mon Oct 27 23:25:56 2025 +0200
[fix][sec] Upgrade Jetty to 9.4.58.v20250814 to address CVE-2025-5115 (#24897)
---
distribution/server/src/assemble/LICENSE.bin.txt | 38 ++++++++++++------------
distribution/shell/src/assemble/LICENSE.bin.txt | 16 +++++-----
pom.xml | 2 +-
3 files changed, 28 insertions(+), 28 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 70c6e1efda9..12b19050084 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -394,25 +394,25 @@ The Apache Software License, Version 2.0
- org.asynchttpclient-async-http-client-2.12.4.jar
- org.asynchttpclient-async-http-client-netty-utils-2.12.4.jar
* Jetty
- - org.eclipse.jetty-jetty-client-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-continuation-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-http-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-io-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-proxy-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-security-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-server-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-servlet-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-servlets-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-util-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-util-ajax-9.4.57.v20241219.jar
- - org.eclipse.jetty.websocket-javax-websocket-client-impl-9.4.57.v20241219.jar
- - org.eclipse.jetty.websocket-websocket-api-9.4.57.v20241219.jar
- - org.eclipse.jetty.websocket-websocket-client-9.4.57.v20241219.jar
- - org.eclipse.jetty.websocket-websocket-common-9.4.57.v20241219.jar
- - org.eclipse.jetty.websocket-websocket-server-9.4.57.v20241219.jar
- - org.eclipse.jetty.websocket-websocket-servlet-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.57.v20241219.jar
- - org.eclipse.jetty-jetty-alpn-server-9.4.57.v20241219.jar
+ - org.eclipse.jetty-jetty-client-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-continuation-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-http-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-io-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-proxy-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-security-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-server-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-servlet-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-servlets-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-util-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-util-ajax-9.4.58.v20250814.jar
+ - org.eclipse.jetty.websocket-javax-websocket-client-impl-9.4.58.v20250814.jar
+ - org.eclipse.jetty.websocket-websocket-api-9.4.58.v20250814.jar
+ - org.eclipse.jetty.websocket-websocket-client-9.4.58.v20250814.jar
+ - org.eclipse.jetty.websocket-websocket-common-9.4.58.v20250814.jar
+ - org.eclipse.jetty.websocket-websocket-server-9.4.58.v20250814.jar
+ - org.eclipse.jetty.websocket-websocket-servlet-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.58.v20250814.jar
+ - org.eclipse.jetty-jetty-alpn-server-9.4.58.v20250814.jar
* SnakeYaml -- org.yaml-snakeyaml-2.0.jar
* RocksDB - org.rocksdb-rocksdbjni-7.9.2.jar
* Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.38.0.jar
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt
index 8aa3b8aef0e..0939d86571f 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -403,14 +403,14 @@ The Apache Software License, Version 2.0
- async-http-client-2.12.4.jar
- async-http-client-netty-utils-2.12.4.jar
* Jetty
- - jetty-client-9.4.57.v20241219.jar
- - jetty-http-9.4.57.v20241219.jar
- - jetty-io-9.4.57.v20241219.jar
- - jetty-util-9.4.57.v20241219.jar
- - javax-websocket-client-impl-9.4.57.v20241219.jar
- - websocket-api-9.4.57.v20241219.jar
- - websocket-client-9.4.57.v20241219.jar
- - websocket-common-9.4.57.v20241219.jar
+ - jetty-client-9.4.58.v20250814.jar
+ - jetty-http-9.4.58.v20250814.jar
+ - jetty-io-9.4.58.v20250814.jar
+ - jetty-util-9.4.58.v20250814.jar
+ - javax-websocket-client-impl-9.4.58.v20250814.jar
+ - websocket-api-9.4.58.v20250814.jar
+ - websocket-client-9.4.58.v20250814.jar
+ - websocket-common-9.4.58.v20250814.jar
* SnakeYaml -- snakeyaml-2.0.jar
* Google Error Prone Annotations - error_prone_annotations-2.38.0.jar
* Javassist -- javassist-3.25.0-GA.jar
diff --git a/pom.xml b/pom.xml
index 5a64fed178a..328c0853d2b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -186,7 +186,7 @@ flexible messaging model and an intuitive client API.</description>
<curator.version>5.7.1</curator.version>
<netty.version>4.1.127.Final</netty.version>
<netty-iouring.version>0.0.26.Final</netty-iouring.version>
- <jetty.version>9.4.57.v20241219</jetty.version>
+ <jetty.version>9.4.58.v20250814</jetty.version>
<conscrypt.version>2.5.2</conscrypt.version>
<jersey.version>2.42</jersey.version>
<athenz.version>1.10.62</athenz.version>
(pulsar) 01/02: [fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (#24889)
Posted by mm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
mmerli pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit a59c490662c1bc301a9e68d56b83e1627edd453f
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Mon Oct 27 21:01:48 2025 +0200
[fix][sec] Bump io.vertx:vertx-web from 4.5.10 to 4.5.22 (#24889)
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
Co-authored-by: Lari Hotari <lh...@apache.org>
---
distribution/server/src/assemble/LICENSE.bin.txt | 10 +++++-----
pom.xml | 2 +-
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index aabf3fd9d79..70c6e1efda9 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -495,11 +495,11 @@ The Apache Software License, Version 2.0
* JCTools - Java Concurrency Tools for the JVM
- org.jctools-jctools-core-2.1.2.jar
* Vertx
- - io.vertx-vertx-auth-common-4.5.10.jar
- - io.vertx-vertx-bridge-common-4.5.10.jar
- - io.vertx-vertx-core-4.5.10.jar
- - io.vertx-vertx-web-4.5.10.jar
- - io.vertx-vertx-web-common-4.5.10.jar
+ - io.vertx-vertx-auth-common-4.5.22.jar
+ - io.vertx-vertx-bridge-common-4.5.22.jar
+ - io.vertx-vertx-core-4.5.22.jar
+ - io.vertx-vertx-web-4.5.22.jar
+ - io.vertx-vertx-web-common-4.5.22.jar
* Apache ZooKeeper
- org.apache.zookeeper-zookeeper-3.9.4.jar
- org.apache.zookeeper-zookeeper-jute-3.9.4.jar
diff --git a/pom.xml b/pom.xml
index 55f1fbf4e22..5a64fed178a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -191,7 +191,7 @@ flexible messaging model and an intuitive client API.</description>
<jersey.version>2.42</jersey.version>
<athenz.version>1.10.62</athenz.version>
<prometheus.version>0.16.0</prometheus.version>
- <vertx.version>4.5.10</vertx.version>
+ <vertx.version>4.5.22</vertx.version>
<rocksdb.version>7.9.2</rocksdb.version>
<slf4j.version>2.0.13</slf4j.version>
<commons.collections4.version>4.4</commons.collections4.version>