You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pinot.apache.org by "xiangfu0 (via GitHub)" <gi...@apache.org> on 2026/10/15 18:48:14 UTC
[PR] Upgrade async-http-client to 3.0.14 to fix security vulnerabilities [pinot]
xiangfu0 opened a new pull request, #19889:
URL: https://github.com/apache/pinot/pull/19889
Upgrade the managed `org.asynchttpclient:async-http-client` version from 3.0.13 to 3.0.14, the patched release for CVE-2026-107230, CVE-2026-107228, CVE-2026-107226, and CVE-2026-107227. This updates consumers such as the Java client without changing their APIs.
### Reproduction
On master before this change, `./mvnw -pl pinot-clients/pinot-java-client -am dependency:tree -Dincludes=org.asynchttpclient:async-http-client` selects 3.0.13. Snyk reports [origin validation](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20571429), [authentication](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20571297), [protection mechanism](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20574185), and [denial of service](https://security.snyk.io/vuln/SNYK-JAVA-ORGASYNCHTTPCLIENT-20571381) vulnerabilities against that version. The [upstream 3.0.14 release](https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14) contains the fixes.
### Validation
- Root-only `spotless:apply`, `license:format`, `checkstyle:check`, and `license:check` passed.
- `./mvnw -pl pinot-clients/pinot-java-client -am -Dtest=JsonAsyncHttpPinotClientTransportTest,SslContextProviderTest,PinotAdminTransportTest -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.compiler.showDeprecation=true -Dmaven.compiler.showWarnings=true -Dcheckstyle.skip -Dspotless.check.skip -Dlicense.skip test` passed: 24 tests, zero failures/errors/skips. Surefire reports confirm the runtime classpath contains async-http-client 3.0.14.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
Re: [PR] Upgrade async-http-client to 3.0.14 to fix security vulnerabilities [pinot]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #19889:
URL: https://github.com/apache/pinot/pull/19889#issuecomment-6201584947
## [Codecov](https://app.codecov.io/gh/apache/pinot/pull/19889?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 100.00%. Comparing base ([`c15cead`](https://app.codecov.io/gh/apache/pinot/commit/c15ceadb2d1e56712686e8124178f7831cb83ac4?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`63c1168`](https://app.codecov.io/gh/apache/pinot/commit/63c1168a77caea7444dec8d2ac7cbd806f3ac6cd?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 2 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #19889 +/- ##
==============================================
+ Coverage 69.26% 100.00% +30.73%
+ Complexity 1491 6 -1485
==============================================
Files 3543 3 -3540
Lines 233237 6 -233231
Branches 37277 0 -37277
==============================================
- Hits 161560 6 -161554
+ Misses 59184 0 -59184
+ Partials 12493 0 -12493
```
| [Flag](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [integration](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (ø)` | |
| [integration1](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (ø)` | |
| [integration2](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [java-25](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (+30.73%)` | :arrow_up: |
| [lane-a](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (ø)` | |
| [lane-b](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `0.00% <ø> (ø)` | |
| [temurin](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (+30.73%)` | :arrow_up: |
| [unittests](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unittests1](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unittests2](https://app.codecov.io/gh/apache/pinot/pull/19889/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/pinot/pull/19889?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org
Re: [PR] Upgrade async-http-client to 3.0.14 to fix security vulnerabilities [pinot]
Posted by "Jackie-Jiang (via GitHub)" <gi...@apache.org>.
Jackie-Jiang merged PR #19889:
URL: https://github.com/apache/pinot/pull/19889
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org