You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by wu...@apache.org on 2025/02/12 04:46:31 UTC
(skywalking) branch master updated: Bump up netty to 4.11.118 and a bunch of GHA to fix CVE-2025-24970 (#13027)
This is an automated email from the ASF dual-hosted git repository.
wusheng pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/skywalking.git
The following commit(s) were added to refs/heads/master by this push:
new b7e961b232 Bump up netty to 4.11.118 and a bunch of GHA to fix CVE-2025-24970 (#13027)
b7e961b232 is described below
commit b7e961b232b4f5cb89d80518e334998e632879ee
Author: kezhenxu94 <ke...@apache.org>
AuthorDate: Wed Feb 12 12:46:26 2025 +0800
Bump up netty to 4.11.118 and a bunch of GHA to fix CVE-2025-24970 (#13027)
---
.github/workflows/codeql.yaml | 2 +-
.github/workflows/dead-link-checker.yaml | 2 +-
.github/workflows/publish-docker-e2e-service.yaml | 6 ++--
.github/workflows/publish-docker.yaml | 8 ++---
.github/workflows/skywalking.yaml | 44 +++++++++++------------
README.md | 2 +-
dist-material/release-docs/LICENSE | 43 +++++++++++-----------
docs/en/changes/changes.md | 1 +
pom.xml | 2 +-
9 files changed, 56 insertions(+), 54 deletions(-)
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index a547a09ac6..aae0290199 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -48,7 +48,7 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v3
+ uses: actions/checkout@v4
with:
submodules: true
diff --git a/.github/workflows/dead-link-checker.yaml b/.github/workflows/dead-link-checker.yaml
index 10fd1fa878..b134daf300 100644
--- a/.github/workflows/dead-link-checker.yaml
+++ b/.github/workflows/dead-link-checker.yaml
@@ -33,7 +33,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
- run: sudo npm install -g markdown-link-check@3.10.0
- run: |
for file in $(find . -name "*.md"); do
diff --git a/.github/workflows/publish-docker-e2e-service.yaml b/.github/workflows/publish-docker-e2e-service.yaml
index 4474fd7087..4c13130f2f 100644
--- a/.github/workflows/publish-docker-e2e-service.yaml
+++ b/.github/workflows/publish-docker-e2e-service.yaml
@@ -39,7 +39,7 @@ jobs:
env:
TAG: ${{ github.sha }}
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Cache local Maven repository
@@ -56,8 +56,8 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v1
+ uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v1
+ uses: docker/setup-buildx-action@v3
- name: Build and push images
run: make -C test build.e2e-service docker.push-e2e-service
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index badf956aae..2332526f16 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -36,7 +36,7 @@ jobs:
packages: write
timeout-minutes: 90
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Cache local Maven repository
@@ -65,15 +65,15 @@ jobs:
echo "TAG=${{ github.sha }}" >> $GITHUB_ENV
fi
- name: Log in to the Container registry
- uses: docker/login-action@v2
+ uses: docker/login-action@v3
with:
registry: ${{ env.DOCKER_REGISTRY }}
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v1
+ uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v1
+ uses: docker/setup-buildx-action@v3
- name: Build and push docker images based on Java 17
env:
SW_OAP_BASE_IMAGE: eclipse-temurin:17-jre
diff --git a/.github/workflows/skywalking.yaml b/.github/workflows/skywalking.yaml
index 7d14091b84..4461c5e8d6 100644
--- a/.github/workflows/skywalking.yaml
+++ b/.github/workflows/skywalking.yaml
@@ -37,7 +37,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Check license header
@@ -49,7 +49,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Check code style
@@ -64,16 +64,16 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
distribution: "temurin"
java-version: "11"
cache: "maven"
- name: Setup Go
- uses: actions/setup-go@v3
+ uses: actions/setup-go@v5
with:
go-version: "1.17"
- name: Check Dependencies Licenses
@@ -111,7 +111,7 @@ jobs:
pom: ${{ steps.filter-pom.outputs.any_modified }}
ui: ${{ steps.filter-ui.outputs.any_modified }}
steps:
- - uses: actions/checkout@v3 # required for push event
+ - uses: actions/checkout@v4 # required for push event
with:
fetch-depth: 0
submodules: true
@@ -166,10 +166,10 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
distribution: "temurin"
java-version: "11"
@@ -200,7 +200,7 @@ jobs:
matrix:
java-version: [11, 17]
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- uses: actions/download-artifact@v4
@@ -209,7 +209,7 @@ jobs:
name: dist
path: dist
- name: Set up Java
- uses: actions/setup-java@v3
+ uses: actions/setup-java@v4
with:
distribution: temurin
java-version: ${{ matrix.java-version }}
@@ -244,7 +244,7 @@ jobs:
- os: ubuntu-latest
java-version: 21
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Cache maven repository
@@ -253,7 +253,7 @@ jobs:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
java-version: ${{ matrix.java-version }}
distribution: temurin
@@ -272,7 +272,7 @@ jobs:
matrix:
java-version: [11, 17, 21]
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Cache maven repository
@@ -281,7 +281,7 @@ jobs:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
java-version: ${{ matrix.java-version }}
distribution: temurin
@@ -306,7 +306,7 @@ jobs:
- name: ElasticSearch / OpenSearch
class: org.apache.skywalking.library.elasticsearch.ElasticSearchIT
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- name: Cache maven repository
@@ -315,7 +315,7 @@ jobs:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
java-version: 11
distribution: temurin
@@ -696,7 +696,7 @@ jobs:
- name: Async Profiler MySQL
config: test/e2e-v2/cases/profiling/async-profiler/mysql/e2e.yaml
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- uses: actions/download-artifact@v4
@@ -709,7 +709,7 @@ jobs:
find docker-images -name "*.tar" -exec docker load -i {} \;
find docker-images -name "*.tar" -exec rm {} \;
- name: Login to ghcr
- uses: docker/login-action@v1
+ uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -770,7 +770,7 @@ jobs:
kubernetes: 28
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- uses: actions/download-artifact@v4
@@ -783,7 +783,7 @@ jobs:
find docker-images -name "*.tar" -exec docker load -i {} \;
find docker-images -name "*.tar" -exec rm {} \;
- name: Login to ghcr
- uses: docker/login-action@v1
+ uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -821,7 +821,7 @@ jobs:
matrix:
java-version: [11, 17]
steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
with:
submodules: true
- uses: actions/download-artifact@v4
@@ -833,7 +833,7 @@ jobs:
run: |
find docker-images -name "*.tar" -exec docker load -i {} \;
find docker-images -name "*.tar" -exec rm {} \;
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
java-version: ${{ matrix.java-version }}
distribution: temurin
diff --git a/README.md b/README.md
index 21d8b8d46c..e4058e7632 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Apache SkyWalking
microservices, cloud native and container-based architectures.
[](https://github.com/apache/skywalking)
-[](https://twitter.com/AsfSkyWalking)
+[](https://x.com/AsfSkyWalking)
[](http://skywalking.apache.org/downloads/)
diff --git a/dist-material/release-docs/LICENSE b/dist-material/release-docs/LICENSE
index d6fd81e1f9..81ba28bf87 100644
--- a/dist-material/release-docs/LICENSE
+++ b/dist-material/release-docs/LICENSE
@@ -303,28 +303,29 @@ The text of each license is the standard Apache 2.0 license.
https://mvnrepository.com/artifact/io.micrometer/micrometer-commons/1.13.0 Apache-2.0
https://mvnrepository.com/artifact/io.micrometer/micrometer-core/1.13.0 Apache-2.0
https://mvnrepository.com/artifact/io.micrometer/micrometer-observation/1.13.0 Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-buffer/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-dns/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-haproxy/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-codec-socks/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-common/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-handler/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-handler-proxy/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-resolver/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-resolver-dns/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-classes-macos/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-native-macos/4.1.115.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-buffer/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-dns/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-haproxy/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-codec-socks/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-common/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-handler/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-handler-proxy/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-resolver/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-resolver-dns/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-classes-macos/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-native-macos/4.1.118.Final Apache-2.0
https://mvnrepository.com/artifact/io.netty/netty-tcnative-boringssl-static/2.0.69.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-tcnative-classes/2.0.69.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport-classes-epoll/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport-classes-kqueue/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport-native-epoll/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport-native-kqueue/4.1.115.Final Apache-2.0
- https://mvnrepository.com/artifact/io.netty/netty-transport-native-unix-common/4.1.115.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-tcnative-boringssl-static/2.0.70.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-tcnative-classes/2.0.70.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport-classes-epoll/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport-classes-kqueue/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport-native-epoll/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport-native-kqueue/4.1.118.Final Apache-2.0
+ https://mvnrepository.com/artifact/io.netty/netty-transport-native-unix-common/4.1.118.Final Apache-2.0
https://mvnrepository.com/artifact/io.perfmark/perfmark-api/0.27.0 Apache-2.0
https://mvnrepository.com/artifact/io.prometheus/simpleclient/0.6.0 Apache-2.0
https://mvnrepository.com/artifact/io.prometheus/simpleclient_common/0.6.0 Apache-2.0
diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md
index 3878e48c47..e226fb0424 100644
--- a/docs/en/changes/changes.md
+++ b/docs/en/changes/changes.md
@@ -69,6 +69,7 @@
* Add `Get Node List in the Cluster` API.
* Add type descriptor when converting Envoy logs to JSON for persistence, to avoid conversion error.
* Bseline: Support query baseline with MQE and use in the Alarm Rule.
+* Bump up netty to 4.11.118 to fix CVE-2025-24970.
#### UI
diff --git a/pom.xml b/pom.xml
index ac4b1862ee..66b2e538f8 100755
--- a/pom.xml
+++ b/pom.xml
@@ -166,7 +166,7 @@
<!-- core lib dependency -->
<grpc.version>1.68.1</grpc.version>
- <netty.version>4.1.115.Final</netty.version>
+ <netty.version>4.1.118.Final</netty.version>
<netty-tcnative-boringssl-static.version>2.0.69.Final</netty-tcnative-boringssl-static.version>
<gson.version>2.9.0</gson.version>
<os-maven-plugin.version>1.6.2</os-maven-plugin.version>