-
Notifications
You must be signed in to change notification settings - Fork 9.1k
HADOOP-19335. Bump netty to 4.1.116 due to CVE-2024-47535 #7158
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
💔 -1 overall
This message was automatically generated. |
c387874
to
b5d6204
Compare
💔 -1 overall
This message was automatically generated. |
Looks like we might need grpc-netty to look at an issue. affects hadoop.yarn.csi.client.TestCsiClient
|
💔 -1 overall
This message was automatically generated. |
67affb5
to
3ce1c00
Compare
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
c3e8fbd
to
0883235
Compare
💔 -1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe we should pull declaration of these two artifacts int hadoop-project pom, declare their versions next to netty and warn that they need to be updated together
@steveloughran I think having to update them together might be the exception as opposed to the rule. In this case, the newer version of netty did affect the old version of grpc-java but there have been many upgrades to netty that didn't impact grpc-java. |
0883235
to
129cc18
Compare
💔 -1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
129cc18
to
792939e
Compare
792939e
to
450059c
Compare
💔 -1 overall
This message was automatically generated. |
@pjfanning is this in a state to merge? did something change or is it just a rebase? |
I upgraded grpc again because I saw it had some bug fixes. |
Of course, netty 4.1.116 is also out too at this stage. |
If that doesn't break anything for us & is just a change in the POM, maybe we can go for it directly |
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
These test failures don't look related, TestAMRMClient is failing in the daily build as well, TestTimelineAuthFilterForV2 looks falky, seems like YARN-11607 didn't fix it well |
Can we do this for branch-3.4? |
I can cherry pick this for branch 3.4 tonight. |
@pjfanning please do. |
…. Contributed by PJ Fanning
…ntributed by PJ Fanning (#7259)
Description of PR
CVE-2024-47535
Also updated grpc-java (to 1.68.2) because the old version of grpc-java didn't work correctly with the upgraded netty. The grpc-java upgrade also means a secure version of protobuf-java will be used by grpc-java. The older version relied on an older version of protobuf-java.
How was this patch tested?
For code changes:
LICENSE
,LICENSE-binary
,NOTICE-binary
files?