Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[HUDI-7338] Upgrade Jetty, HBase, and pulsar-client #10223

Merged
merged 1 commit into from
Feb 6, 2024

Conversation

CTTY
Copy link
Contributor

@CTTY CTTY commented Nov 30, 2023

Change Logs

Bump version of Jetty ,HBase ,and pulsar-client

Impact

None

Risk level (write none, low medium or high below)

None

Documentation Update

Describe any necessary documentation update if there is any new feature, config, or user-facing change

N/A

Contributor's checklist

  • Read through contributor's guide
  • Change Logs and Impact were stated clearly
  • Adequate tests were added if applicable
  • CI passed

<exclusion>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-shaded-jetty</artifactId>
</exclusion>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@CTTY CTTY changed the title CVE-2023-44487 Upgrade jetty and exclude older jetty [WIP] CVE-2023-44487 Upgrade jetty and exclude older jetty Dec 1, 2023
@CTTY
Copy link
Contributor Author

CTTY commented Dec 1, 2023

@hudi-bot run azure

@CTTY CTTY changed the title [WIP] CVE-2023-44487 Upgrade jetty and exclude older jetty [] CVE-2023-44487 Upgrade jetty and exclude older jetty Dec 1, 2023
<exclusion>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-shaded-jetty</artifactId>
</exclusion>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @yihua for the review~

Copy link
Contributor Author

@CTTY CTTY Dec 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @danny0405, thanks for helping out but this PR is still WIP.

Hudi uses hbase-shaded-netty from hbase thirdparty package and the netty is outdated there. Even the latest OSS hbase thirdparty won't have the fixed netty version(https://github.com/apache/hbase-thirdparty/blob/master/pom.xml#L137) (the fixed netty version is 4.1.100).
I'm still trying to figure out how to exclude netty from that shaded package. But would be happy to hear if you have any idea

@CTTY
Copy link
Contributor Author

CTTY commented Jan 2, 2024

@hudi-bot run azure

@CTTY CTTY force-pushed the ctty/jetty-cve-fix branch 2 times, most recently from 536833e to 4827a8d Compare January 9, 2024 02:11
@CTTY CTTY force-pushed the ctty/jetty-cve-fix branch from 157fb0e to d197ce8 Compare January 25, 2024 00:08
@hudi-bot
Copy link

CI report:

Bot commands @hudi-bot supports the following commands:
  • @hudi-bot run azure re-run the last Azure build

@CTTY CTTY changed the title [] CVE-2023-44487 Upgrade jetty and exclude older jetty [HUDI-7338] Upgrade Jetty, HBase, and pulsar-client Jan 25, 2024
@CTTY
Copy link
Contributor Author

CTTY commented Jan 25, 2024

Hi @danny0405,

Could you help take a look again? Thanks!

@danny0405 danny0405 merged commit c1d4701 into apache:master Feb 6, 2024
31 of 33 checks passed
yihua pushed a commit that referenced this pull request Feb 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants