You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@seata.apache.org by "s-ramyalakshmi (via GitHub)" <gi...@apache.org> on 2025/03/11 05:47:51 UTC
[PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
s-ramyalakshmi opened a new pull request, #7202:
URL: https://github.com/apache/incubator-seata/pull/7202
<!-- Please make sure you have read and understood the contributing guidelines -->
- [x] I have registered the PR [changes](../changes).
### Ⅰ. Describe what this PR did
Resolved potential Denial of Service issue of protobuf-java by upgrading the version from 3.25.4 to 3.25.5.
### Ⅱ. Does this pull request fix one issue?
fixes #7201
### Ⅲ. Why don't you add test cases (unit test/integration test)?
N/A
### Ⅳ. Describe how to verify it
### Ⅴ. Special notes for reviews
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1988458261
##########
changes/en-us/2.x.md:
##########
@@ -30,6 +30,7 @@ Add changes here for all PR submitted to the 2.x branch.
- [[#7150](https://github.com/apache/incubator-seata/pull/7150)] The time difference between the raft node and the follower node cannot synchronize data
- [[#7102](https://github.com/apache/incubator-seata/pull/7150)] bugfix: modify XA mode pre commit transaction from commit phase to before close phase
- [[#7188](https://github.com/apache/incubator-seata/pull/7188)] bugfix: Fix missing branchType in BusinessActionContext
+- [[#7201](https://github.com/apache/incubator-seata/issues/7201)] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue
Review Comment:
IMHO, @funky-eyes ’ suggestion makes sense.
@s-ramyalakshmi
please add changes in below file too :)
https://github.com/apache/incubator-seata/blob/2.x/changes/zh-cn/2.x.md
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1988463579
##########
changes/en-us/2.x.md:
##########
@@ -30,6 +30,7 @@ Add changes here for all PR submitted to the 2.x branch.
- [[#7150](https://github.com/apache/incubator-seata/pull/7150)] The time difference between the raft node and the follower node cannot synchronize data
- [[#7102](https://github.com/apache/incubator-seata/pull/7150)] bugfix: modify XA mode pre commit transaction from commit phase to before close phase
- [[#7188](https://github.com/apache/incubator-seata/pull/7188)] bugfix: Fix missing branchType in BusinessActionContext
+- [[#7201](https://github.com/apache/incubator-seata/issues/7201)] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue
Review Comment:
@YongGoose Thanks for letting me know. I have added changes to zh-cn folder as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#issuecomment-2716132923
If you're using the DingTalk app, please send your DingTalk account to my email at `jianbin@apache.org`, and I will invite you to join the Seata developer group
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#issuecomment-2715227309
Hi, Would rebuilding help in passing the check?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1988455614
##########
changes/en-us/2.x.md:
##########
@@ -30,6 +30,7 @@ Add changes here for all PR submitted to the 2.x branch.
- [[#7150](https://github.com/apache/incubator-seata/pull/7150)] The time difference between the raft node and the follower node cannot synchronize data
- [[#7102](https://github.com/apache/incubator-seata/pull/7150)] bugfix: modify XA mode pre commit transaction from commit phase to before close phase
- [[#7188](https://github.com/apache/incubator-seata/pull/7188)] bugfix: Fix missing branchType in BusinessActionContext
+- [[#7201](https://github.com/apache/incubator-seata/issues/7201)] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue
Review Comment:
Yes, that makes sense. I will update the change log.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#issuecomment-2970371792
> > If you're using the DingTalk app, please send your DingTalk account to my email at `jianbin@apache.org`, and I will invite you to join the Seata developer group
>
> I have sent you an email. Thank you!
I apologize for the late reply, but I've searched through my inbox and couldn't find any email from you. I'm quite confused about this. Would you mind sending the email again?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1989352071
##########
changes/en-us/2.x.md:
##########
Review Comment:
I have updated the file, added my Github ID. Thank you!
##########
changes/zh-cn/2.x.md:
##########
Review Comment:
I have updated the file, added my Github ID. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1988587305
##########
changes/zh-cn/2.x.md:
##########
Review Comment:
You should append your GitHub ID after line 97
##########
changes/en-us/2.x.md:
##########
Review Comment:
You should append your GitHub ID after line 97
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#issuecomment-2712852647
## [Codecov](https://app.codecov.io/gh/apache/incubator-seata/pull/7202?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 51.66%. Comparing base [(`151ea4f`)](https://app.codecov.io/gh/apache/incubator-seata/commit/151ea4f6757fab260ea21227ab793e0cdeee2d92?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`f15ae90`)](https://app.codecov.io/gh/apache/incubator-seata/commit/f15ae902a7fb1a0b3ab5c3fcdf8934083ca3a815?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/incubator-seata/pull/7202?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## 2.x #7202 +/- ##
============================================
- Coverage 51.69% 51.66% -0.03%
+ Complexity 6841 6837 -4
============================================
Files 1169 1169
Lines 41585 41585
Branches 4871 4871
============================================
- Hits 21496 21486 -10
- Misses 18041 18050 +9
- Partials 2048 2049 +1
```
[see 4 files with indirect coverage changes](https://app.codecov.io/gh/apache/incubator-seata/pull/7202/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary>🚀 New features to boost your workflow: </summary>
- ❄ [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- 📦 [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1988455614
##########
changes/en-us/2.x.md:
##########
@@ -30,6 +30,7 @@ Add changes here for all PR submitted to the 2.x branch.
- [[#7150](https://github.com/apache/incubator-seata/pull/7150)] The time difference between the raft node and the follower node cannot synchronize data
- [[#7102](https://github.com/apache/incubator-seata/pull/7150)] bugfix: modify XA mode pre commit transaction from commit phase to before close phase
- [[#7188](https://github.com/apache/incubator-seata/pull/7188)] bugfix: Fix missing branchType in BusinessActionContext
+- [[#7201](https://github.com/apache/incubator-seata/issues/7201)] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue
Review Comment:
Yes, that makes sense. I have updated the change log
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes merged PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1989349896
##########
changes/zh-cn/2.x.md:
##########
Review Comment:
Added Github ID, Thanks.
##########
changes/en-us/2.x.md:
##########
Review Comment:
Added Github ID, Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on code in PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#discussion_r1988450869
##########
changes/en-us/2.x.md:
##########
@@ -30,6 +30,7 @@ Add changes here for all PR submitted to the 2.x branch.
- [[#7150](https://github.com/apache/incubator-seata/pull/7150)] The time difference between the raft node and the follower node cannot synchronize data
- [[#7102](https://github.com/apache/incubator-seata/pull/7150)] bugfix: modify XA mode pre commit transaction from commit phase to before close phase
- [[#7188](https://github.com/apache/incubator-seata/pull/7188)] bugfix: Fix missing branchType in BusinessActionContext
+- [[#7201](https://github.com/apache/incubator-seata/issues/7201)] bugfix: update protobuf.version from 3.25.4 to 3.25.5 to resolve potential DoS issue
Review Comment:
I think this PR belongs to the security category. What do you think?
Thanks to these contributors for their code commits. Please report an unintended omission.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] optimize: upgrade protobuf version from 3.25.4 to 3.25.5 [incubator-seata]
Posted by "s-ramyalakshmi (via GitHub)" <gi...@apache.org>.
s-ramyalakshmi commented on PR #7202:
URL: https://github.com/apache/incubator-seata/pull/7202#issuecomment-2722830917
> If you're using the DingTalk app, please send your DingTalk account to my email at `jianbin@apache.org`, and I will invite you to join the Seata developer group
I have sent you an email. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org