You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "lhotari (via GitHub)" <gi...@apache.org> on 2024/02/28 06:36:27 UTC
[PR] [fix][sec] Upgrade Jetty to 9.4.54.v20240208 to address CVE-2024-22201 [pulsar]
lhotari opened a new pull request, #22144:
URL: https://github.com/apache/pulsar/pull/22144
### Motivation & Modifications
Upgrade Jetty to 9.4.54.v20240208 to address CVE-2024-22201
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Upgrade Jetty to 9.4.54.v20240208 to address CVE-2024-22201 [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #22144:
URL: https://github.com/apache/pulsar/pull/22144
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Upgrade Jetty to 9.4.54.v20240208 to address CVE-2024-22201 [pulsar]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #22144:
URL: https://github.com/apache/pulsar/pull/22144#issuecomment-1968475298
## [Codecov](https://app.codecov.io/gh/apache/pulsar/pull/22144?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 73.52%. Comparing base [(`bbc6224`)](https://app.codecov.io/gh/apache/pulsar/commit/bbc62245c5ddba1de4b1e7cee4ab49334bc36277?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`6fbf978`)](https://app.codecov.io/gh/apache/pulsar/pull/22144?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
> Report is 10 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/pulsar/pull/22144?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## master #22144 +/- ##
============================================
- Coverage 73.57% 73.52% -0.05%
+ Complexity 32624 32124 -500
============================================
Files 1877 1877
Lines 139502 139546 +44
Branches 15299 15312 +13
============================================
- Hits 102638 102603 -35
- Misses 28908 28968 +60
- Partials 7956 7975 +19
```
| [Flag](https://app.codecov.io/gh/apache/pulsar/pull/22144/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [inttests](https://app.codecov.io/gh/apache/pulsar/pull/22144/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `24.59% <ø> (+0.01%)` | :arrow_up: |
| [systests](https://app.codecov.io/gh/apache/pulsar/pull/22144/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `24.21% <ø> (-0.12%)` | :arrow_down: |
| [unittests](https://app.codecov.io/gh/apache/pulsar/pull/22144/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `72.80% <ø> (-0.05%)` | :arrow_down: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
[see 60 files with indirect coverage changes](https://app.codecov.io/gh/apache/pulsar/pull/22144/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Upgrade Jetty to 9.4.54.v20240208 to address CVE-2024-22201 [pulsar]
Posted by "heesung-sn (via GitHub)" <gi...@apache.org>.
heesung-sn commented on PR #22144:
URL: https://github.com/apache/pulsar/pull/22144#issuecomment-1972065126
```diff
hsohn@HeesungSohns-MacBook-Pro pulsar-release % git diff
diff --cc pom.xml
index 122b551d0e,f161165b7b..0000000000
--- a/pom.xml
+++ b/pom.xml
@@@ -140,9 -144,9 +140,15 @@@ flexible messaging model and an intuiti
<snappy.version>1.1.10.5</snappy.version> <!-- ZooKeeper server -->
<dropwizardmetrics.version>4.1.12.1</dropwizardmetrics.version> <!-- ZooKeeper server -->
<curator.version>5.1.0</curator.version>
++<<<<<<< HEAD
+ <netty.version>4.1.100.Final</netty.version>
+ <netty-iouring.version>0.0.21.Final</netty-iouring.version>
+ <jetty.version>9.4.53.v20231009</jetty.version>
++=======
+ <netty.version>4.1.105.Final</netty.version>
+ <netty-iouring.version>0.0.24.Final</netty-iouring.version>
+ <jetty.version>9.4.54.v20240208</jetty.version>
++>>>>>>> e3a081e4c5 ([fix][sec] Upgrade Jetty to 9.4.54.v20240208 to address CVE-2024-22201 (#22144))
<conscrypt.version>2.5.2</conscrypt.version>
<jersey.version>2.34</jersey.version>
<athenz.version>1.10.50</athenz.version>
```
We have a conflict in branch-3.0. @lhotari do we need a PR for this conflict?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org