Re: [PR] Bump Netty to 4.1.136.Final and jackson-databind to 2.18.9 [tinkerpop]

["xiazcy (via GitHub)" <gi...@apache.org>]

xiazcy commented on code in PR #3583:
URL: https://github.com/apache/tinkerpop/pull/3583#discussion_r3678506260


##########
pom.xml:
##########
@@ -174,12 +174,12 @@ limitations under the License.
         <logback.version>1.2.13</logback.version>
         <metrics.version>3.0.2</metrics.version>
         <mockito.version>3.10.0</mockito.version>
-        <netty.version>4.1.125.Final</netty.version>
+        <netty.version>4.1.136.Final</netty.version>

Review Comment:
   Nit: there's a stale comment inside `gremlin-server/pom.xml` referring to `https://github.com/netty/netty/blob/netty-4.1.125.Final/pom.xml#L963` for the bouncycastle pin rationale, given the version bumps, comment should be updated.



##########
gremlin-core/src/test/java/org/apache/tinkerpop/gremlin/structure/io/graphson/GraphSONStreamConstraintsTest.java:
##########
@@ -48,8 +48,8 @@ public void testMaxNumberLengthConfig() throws Exception {
             serializeDeserializeAuto(mapper, serializedData);
         });
         assertTrue("Expected StreamConstraintsException for exceeding max number length, found: "+exception.getMessage(),
-                exception.getMessage().contains("org.apache.tinkerpop.shaded.jackson.core.exc.StreamConstraintsException: Number length")
-                && exception.getMessage().contains("exceeds the maximum length (2)"));
+                exception.getMessage().contains("org.apache.tinkerpop.shaded.jackson.core.exc.StreamConstraintsException: Number value length")
+                && exception.getMessage().contains("exceeds the maximum allowed (2, from `StreamReadConstraints.getMaxNumberLength()`)"));

Review Comment:
   It seems like our assertions depends on the Jackson error message wording, is there a way to just assert the exception type + limit value instead?



##########
gremlin-shaded/pom.xml:
##########
@@ -48,7 +48,7 @@ limitations under the License.
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.15.2</version>
+            <version>2.18.9</version>

Review Comment:
   I see your commit message said about deferring the issue of transient dependencies for hadoop/spark/sparql still pulling in the older Jackson, should that point be mentioned more visibly somewhere in the docs for now? And perhaps opening a Jira for that?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org