Repository navigation
[fix][sec] [branch-4.0] Upgrade AsyncHttpClient to 3.0.14 and Netty to 4.2.19 - #27120
Closed
Technoboy- wants to merge 2 commits into
Closed
Technoboy- wants to merge 2 commits into
Technoboy- wants to merge 2 commits into
Conversation
Upgrade AsyncHttpClient and Netty Reactive Streams to 3.0.14 and 2.0.20 for the HTTP client security fixes reported in support ticket apache#5132. Adapt Duration-based timeouts, add the HTTP/2 runtime dependency, and migrate io_uring to the Netty 4.2 transport API. Preserve Broker per-message auto-read throttling using the handler and regression tests from upstream 94890cb. Add HTTPS lookup and actual socket transport regressions, and update distribution license entries. Raise the Java client minimum to Java 11 and remove the obsolete Java 8 integration-test profile so the published bytecode check reflects the new dependencies' requirements. Validation: selected reactor tests passed (145 passed, 1 io_uring skip); all three shaded client artifacts built with bytecode enforcement; Client/Admin startup passed on Java 11; Linux ARM64 Epoll and flow control tests passed. Full cluster E2E was not run.
Technoboy-
changed the title
Technoboy-
changed the title
lhotari
requested changes
Oct 26, 2026
lhotari
left a comment
lhotari
left a comment
Member
There was a problem hiding this comment.
branch-4.0 AsyncHttpClient should be kept on 2.x and Netty on 4.1.x.
AsyncHttpClient 2.16.1 most likely already contains the fixes.
Netty 4.1.139.Final contains the same fixes as 4.2.19.Final.
Mark the recyclable flow-control queue's runtime-only handle transient to fix SpotBugs SE_BAD_FIELD. Declare netty-common and netty-buffer as provided dependencies for the message crypto module, and remove the obsolete lombok.var import now that clients compile for Java 11. Align the binary license manifests with the actual distribution: retain BookKeeper's transitive incubator io_uring jars, update JetBrains annotations, and remove unused legacy codec artifacts. Validation: CI core-modules clean install with SpotBugs enabled passed; the rebuilt server distribution passed src/check-binary-license.sh; 2 flow-control and 16 ACK-grouping tests passed.
Contributor
Author
@lhotari Do you read the cve ? |
Member
|
Discussion in #27121. |
Member
|
Concern about BK while upgrading to Netty 4.2.x: #27121 (comment) |
Contributor
Author
ok, I see |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
For fixing the "CVE-2026-107227"
Some implementation like : MultiThreadIoEventLoopGroup to replace IOUringEventLoopGroup, PulsarFlowControlHandler are copyed from master branch.