You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "lhotari (via GitHub)" <gi...@apache.org> on 2025/09/08 17:24:41 UTC
[PR] [fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs [pulsar]
lhotari opened a new pull request, #24717:
URL: https://github.com/apache/pulsar/pull/24717
### Motivation
Addresses CVE-2025-58057 and CVE-2025-58056 in Netty. Pulsar users aren't impacted, but we need to use dependencies that don't contain known CVEs.
Release notes
* https://netty.io/news/2025/09/03/4-1-126-Final.html
* https://netty.io/news/2025/09/08/4-1-127-Final.html
Netty tcnative was upgraded to 2.0.73.Final as a transitive dependency.
- [changes in netty-tcnative 2.0.73.Final](https://github.com/netty/netty-tcnative/compare/netty-tcnative-parent-2.0.72.Final...netty-tcnative-parent-2.0.73.Final)
### Modifications
- upgrade to Netty 4.1.127.Final
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs [pulsar]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #24717:
URL: https://github.com/apache/pulsar/pull/24717#issuecomment-3267488876
## [Codecov](https://app.codecov.io/gh/apache/pulsar/pull/24717?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 74.14%. Comparing base ([`0a949de`](https://app.codecov.io/gh/apache/pulsar/commit/0a949de4bfa3734194be87a8655763a4411be1b6?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`26a4333`](https://app.codecov.io/gh/apache/pulsar/commit/26a4333399a2f78ce654acc33ef71f4687a0f151?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 3 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/pulsar/pull/24717?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## master #24717 +/- ##
============================================
- Coverage 74.29% 74.14% -0.16%
- Complexity 33140 33440 +300
============================================
Files 1895 1895
Lines 147979 147979
Branches 17137 17137
============================================
- Hits 109942 109714 -228
- Misses 29317 29507 +190
- Partials 8720 8758 +38
```
| [Flag](https://app.codecov.io/gh/apache/pulsar/pull/24717/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [inttests](https://app.codecov.io/gh/apache/pulsar/pull/24717/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `26.37% <ø> (-0.21%)` | :arrow_down: |
| [systests](https://app.codecov.io/gh/apache/pulsar/pull/24717/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `22.59% <ø> (-0.23%)` | :arrow_down: |
| [unittests](https://app.codecov.io/gh/apache/pulsar/pull/24717/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `73.67% <ø> (-0.13%)` | :arrow_down: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
[see 80 files with indirect coverage changes](https://app.codecov.io/gh/apache/pulsar/pull/24717/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Upgrade Netty to 4.1.127.Final to address CVEs [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #24717:
URL: https://github.com/apache/pulsar/pull/24717
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org