HIVE-28040: Upgrade netty to 4.1.116.Final due to CVEs #5592
Conversation
asf-ci-hive
added
tests pending
tests unstable
and removed
tests unstable
tests pending
labels
…ersion" This reverts commit 8a776d1.
pom.xml
Outdated
| @@ -110,7 +110,7 @@ | |||
| <antlr4.version>4.9.3</antlr4.version> | |||
| <apache-directory-server.version>1.5.7</apache-directory-server.version> | |||
| <!-- Include arrow for LlapOutputFormatService --> | |||
| <arrow.version>12.0.0</arrow.version> | |||
| <arrow.version>16.1.0</arrow.version> | |||
There was a problem hiding this comment.
I guess this Apache Arrow is compiled by a different JDK version
[2024-12-29T18:31:23.075Z] Caused by: java.lang.NoSuchMethodError: java.nio.ByteBuffer.position(I)Ljava/nio/ByteBuffer;
[2024-12-29T18:31:23.075Z] at org.apache.arrow.memory.ArrowBuf.setBytes(ArrowBuf.java:850)
[2024-12-29T18:31:23.075Z] at io.netty.buffer.NettyArrowBuf.setBytes(NettyArrowBuf.java:278)
[2024-12-29T18:31:23.075Z] at io.netty.buffer.MutableWrappedByteBuf.setBytes(MutableWrappedByteBuf.java:341)
[2024-12-29T18:31:23.075Z] at io.netty.buffer.ExpandableByteBuf.setBytes(ExpandableByteBuf.java:27)
[2024-12-29T18:31:23.075Z] at io.netty.buffer.AbstractByteBuf.writeBytes(AbstractByteBuf.java:1113)
There was a problem hiding this comment.
my bad, arrow v15.0.0 was producing some license-related issues causing compilation failure.
Instead, have upgraded to v16.0.0
asf-ci-hive
added
tests pending
tests failed
and removed
tests unstable
tests pending
labels
This reverts commit cd3eb8f.
asf-ci-hive
added
tests pending
tests unstable
and removed
tests failed
tests pending
labels
This reverts commit 5de7b98.
tanishq-chugh
force-pushed
the
HIVE-28040
branch
from
91bb63f to
6690b8c
Compare
asf-ci-hive
added
tests pending
tests unstable
and removed
tests unstable
tests pending
labels
pom.xml
Outdated
| <netty.version>4.1.77.Final</netty.version> | ||
| <netty.version>4.1.108.Final</netty.version> |
There was a problem hiding this comment.
netty 4.1.116 is around, we should upgrade to latest IMO
https://mvnrepository.com/artifact/io.netty/netty-all/4.1.116.Final
There was a problem hiding this comment.
CVE-2024-47535
this CVE is fixed in 4.1.115, It will be good that if we moved it to 4.1.116 as @ayushtkn suggested. Thanks.
There was a problem hiding this comment.
Thanks for checking this out.
|
@tanishq-chugh |
|
ayushtkn
changed the title
|
LGTM |
What changes were proposed in this pull request?
Upgrade Netty due to CVEs
Why are the changes needed?
Fixing CVEs
Does this PR introduce any user-facing change?
No
Is the change a dependency upgrade?
Yes
Dependency tree:
dpn_netty_116.txt
How was this patch tested?
Manual Testing by running few queries after local compilation