[fix][sec] [branch-4.0] Upgrade AsyncHttpClient to 3.0.14 and Netty to 4.2.19

distribution/server/src/assemble/LICENSE.bin.txt

@@ -273,7 +273,7 @@ The Apache Software License, Version 2.0
     - com.google.guava-failureaccess-1.0.1.jar
     - com.google.guava-listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- com.google.j2objc-j2objc-annotations-1.3.jar
- * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.6.jar
+ * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.20.jar
  * Swagger
     - io.swagger-swagger-annotations-1.6.2.jar
     - io.swagger-swagger-core-1.6.2.jar
@@ -294,33 +294,37 @@ The Apache Software License, Version 2.0
     - org.apache.commons-commons-lang3-3.19.0.jar
     - org.apache.commons-commons-text-1.15.0.jar
  * Netty
-    - io.netty-netty-buffer-4.1.139.Final.jar
-    - io.netty-netty-codec-4.1.139.Final.jar
-    - io.netty-netty-codec-dns-4.1.139.Final.jar
-    - io.netty-netty-codec-http-4.1.139.Final.jar
-    - io.netty-netty-codec-http2-4.1.139.Final.jar
-    - io.netty-netty-codec-socks-4.1.139.Final.jar
-    - io.netty-netty-codec-haproxy-4.1.139.Final.jar
-    - io.netty-netty-common-4.1.139.Final.jar
-    - io.netty-netty-handler-4.1.139.Final.jar
-    - io.netty-netty-handler-proxy-4.1.139.Final.jar
-    - io.netty-netty-resolver-4.1.139.Final.jar
-    - io.netty-netty-resolver-dns-4.1.139.Final.jar
-    - io.netty-netty-resolver-dns-classes-macos-4.1.139.Final.jar
-    - io.netty-netty-resolver-dns-native-macos-4.1.139.Final-osx-aarch_64.jar
-    - io.netty-netty-resolver-dns-native-macos-4.1.139.Final-osx-x86_64.jar
-    - io.netty-netty-transport-4.1.139.Final.jar
-    - io.netty-netty-transport-classes-epoll-4.1.139.Final.jar
-    - io.netty-netty-transport-native-epoll-4.1.139.Final-linux-aarch_64.jar
-    - io.netty-netty-transport-native-epoll-4.1.139.Final-linux-x86_64.jar
-    - io.netty-netty-transport-native-unix-common-4.1.139.Final.jar
+    - io.netty-netty-buffer-4.2.19.Final.jar
+    - io.netty-netty-codec-base-4.2.19.Final.jar
+    - io.netty-netty-codec-compression-4.2.19.Final.jar
+    - io.netty-netty-codec-dns-4.2.19.Final.jar
+    - io.netty-netty-codec-http-4.2.19.Final.jar
+    - io.netty-netty-codec-http2-4.2.19.Final.jar
+    - io.netty-netty-codec-socks-4.2.19.Final.jar
+    - io.netty-netty-codec-haproxy-4.2.19.Final.jar
+    - io.netty-netty-common-4.2.19.Final.jar
+    - io.netty-netty-handler-4.2.19.Final.jar
+    - io.netty-netty-handler-proxy-4.2.19.Final.jar
+    - io.netty-netty-resolver-4.2.19.Final.jar
+    - io.netty-netty-resolver-dns-4.2.19.Final.jar
+    - io.netty-netty-resolver-dns-classes-macos-4.2.19.Final.jar
+    - io.netty-netty-resolver-dns-native-macos-4.2.19.Final-osx-aarch_64.jar
+    - io.netty-netty-resolver-dns-native-macos-4.2.19.Final-osx-x86_64.jar
+    - io.netty-netty-transport-4.2.19.Final.jar
+    - io.netty-netty-transport-classes-epoll-4.2.19.Final.jar
+    - io.netty-netty-transport-native-epoll-4.2.19.Final-linux-aarch_64.jar
+    - io.netty-netty-transport-native-epoll-4.2.19.Final-linux-x86_64.jar
+    - io.netty-netty-transport-native-unix-common-4.2.19.Final.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.84.Final.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.84.Final-linux-aarch_64.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.84.Final-linux-x86_64.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.84.Final-osx-aarch_64.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.84.Final-osx-x86_64.jar
     - io.netty-netty-tcnative-boringssl-static-2.0.84.Final-windows-x86_64.jar
     - io.netty-netty-tcnative-classes-2.0.84.Final.jar
+    - io.netty-netty-transport-classes-io_uring-4.2.19.Final.jar
+    - io.netty-netty-transport-native-io_uring-4.2.19.Final-linux-x86_64.jar
+    - io.netty-netty-transport-native-io_uring-4.2.19.Final-linux-aarch_64.jar
     - io.netty.incubator-netty-incubator-transport-classes-io_uring-0.0.26.Final.jar
     - io.netty.incubator-netty-incubator-transport-native-io_uring-0.0.26.Final-linux-x86_64.jar
     - io.netty.incubator-netty-incubator-transport-native-io_uring-0.0.26.Final-linux-aarch_64.jar
@@ -390,8 +394,7 @@ The Apache Software License, Version 2.0
  * AirCompressor
     - io.airlift-aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - org.asynchttpclient-async-http-client-2.16.1.jar
-    - org.asynchttpclient-async-http-client-netty-utils-2.16.1.jar
+    - org.asynchttpclient-async-http-client-3.0.14.jar
  * Jetty
     - org.eclipse.jetty-jetty-alpn-client-12.1.13.jar
     - org.eclipse.jetty-jetty-alpn-conscrypt-server-12.1.13.jar
@@ -444,7 +447,7 @@ The Apache Software License, Version 2.0
  * Javassist -- org.javassist-javassist-3.25.0-GA.jar
  * Kotlin Standard Lib
      - org.jetbrains.kotlin-kotlin-stdlib-2.2.21.jar
-     - org.jetbrains-annotations-13.0.jar
+     - org.jetbrains-annotations-26.1.0.jar
  * gRPC
     - io.grpc-grpc-all-1.75.0.jar
     - io.grpc-grpc-auth-1.75.0.jar

distribution/shell/src/assemble/LICENSE.bin.txt

@@ -333,7 +333,7 @@ The Apache Software License, Version 2.0
     - failureaccess-1.0.1.jar
     - listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- j2objc-annotations-1.3.jar
- * Netty Reactive Streams -- netty-reactive-streams-2.0.6.jar
+ * Netty Reactive Streams -- netty-reactive-streams-2.0.20.jar
  * Swagger -- swagger-annotations-1.6.2.jar
  * DataSketches
     - memory-0.8.3.jar
@@ -345,35 +345,37 @@ The Apache Software License, Version 2.0
     - commons-text-1.15.0.jar
     - commons-compress-1.28.0.jar
  * Netty
-    - netty-buffer-4.1.139.Final.jar
-    - netty-codec-4.1.139.Final.jar
-    - netty-codec-dns-4.1.139.Final.jar
-    - netty-codec-http-4.1.139.Final.jar
-    - netty-codec-socks-4.1.139.Final.jar
-    - netty-codec-haproxy-4.1.139.Final.jar
-    - netty-common-4.1.139.Final.jar
-    - netty-handler-4.1.139.Final.jar
-    - netty-handler-proxy-4.1.139.Final.jar
-    - netty-resolver-4.1.139.Final.jar
-    - netty-resolver-dns-4.1.139.Final.jar
-    - netty-transport-4.1.139.Final.jar
-    - netty-transport-classes-epoll-4.1.139.Final.jar
-    - netty-transport-native-epoll-4.1.139.Final-linux-aarch_64.jar
-    - netty-transport-native-epoll-4.1.139.Final-linux-x86_64.jar
-    - netty-transport-native-unix-common-4.1.139.Final.jar
+    - netty-buffer-4.2.19.Final.jar
+    - netty-codec-base-4.2.19.Final.jar
+    - netty-codec-compression-4.2.19.Final.jar
+    - netty-codec-dns-4.2.19.Final.jar
+    - netty-codec-http-4.2.19.Final.jar
+    - netty-codec-http2-4.2.19.Final.jar
+    - netty-codec-socks-4.2.19.Final.jar
+    - netty-codec-haproxy-4.2.19.Final.jar
+    - netty-common-4.2.19.Final.jar
+    - netty-handler-4.2.19.Final.jar
+    - netty-handler-proxy-4.2.19.Final.jar
+    - netty-resolver-4.2.19.Final.jar
+    - netty-resolver-dns-4.2.19.Final.jar
+    - netty-transport-4.2.19.Final.jar
+    - netty-transport-classes-epoll-4.2.19.Final.jar
+    - netty-transport-native-epoll-4.2.19.Final-linux-aarch_64.jar
+    - netty-transport-native-epoll-4.2.19.Final-linux-x86_64.jar
+    - netty-transport-native-unix-common-4.2.19.Final.jar
     - netty-tcnative-boringssl-static-2.0.84.Final.jar
     - netty-tcnative-boringssl-static-2.0.84.Final-linux-aarch_64.jar
     - netty-tcnative-boringssl-static-2.0.84.Final-linux-x86_64.jar
     - netty-tcnative-boringssl-static-2.0.84.Final-osx-aarch_64.jar
     - netty-tcnative-boringssl-static-2.0.84.Final-osx-x86_64.jar
     - netty-tcnative-boringssl-static-2.0.84.Final-windows-x86_64.jar
     - netty-tcnative-classes-2.0.84.Final.jar
-    - netty-incubator-transport-classes-io_uring-0.0.26.Final.jar
-    - netty-incubator-transport-native-io_uring-0.0.26.Final-linux-aarch_64.jar
-    - netty-incubator-transport-native-io_uring-0.0.26.Final-linux-x86_64.jar
-    - netty-resolver-dns-classes-macos-4.1.139.Final.jar
-    - netty-resolver-dns-native-macos-4.1.139.Final-osx-aarch_64.jar
-    - netty-resolver-dns-native-macos-4.1.139.Final-osx-x86_64.jar
+    - netty-transport-classes-io_uring-4.2.19.Final.jar
+    - netty-transport-native-io_uring-4.2.19.Final-linux-aarch_64.jar
+    - netty-transport-native-io_uring-4.2.19.Final-linux-x86_64.jar
+    - netty-resolver-dns-classes-macos-4.2.19.Final.jar
+    - netty-resolver-dns-native-macos-4.2.19.Final-osx-aarch_64.jar
+    - netty-resolver-dns-native-macos-4.2.19.Final-osx-x86_64.jar
  * Prometheus client
     - simpleclient-0.16.0.jar
     - simpleclient_log4j2-0.16.0.jar
@@ -398,8 +400,7 @@ The Apache Software License, Version 2.0
   * AirCompressor
      - aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - async-http-client-2.16.1.jar
-    - async-http-client-netty-utils-2.16.1.jar
+    - async-http-client-3.0.14.jar
  * Jetty
     - jetty-alpn-client-12.1.13.jar
     - jetty-client-12.1.13.jar

pom.xml

@@ -80,7 +80,8 @@ flexible messaging model and an intuitive client API.</description>
     <maven.compiler.source>17</maven.compiler.source>
     <maven.compiler.target>17</maven.compiler.target>
     <pulsar.broker.compiler.release>${maven.compiler.target}</pulsar.broker.compiler.release>
-    <pulsar.client.compiler.release>8</pulsar.client.compiler.release>
+    <!-- AHC 3.x and Netty 4.2 require Java 11 for the Java client artifacts. -->
+    <pulsar.client.compiler.release>11</pulsar.client.compiler.release>
 
     <pulsar.client.python.version>3.13.0</pulsar.client.python.version>
 
@@ -184,8 +185,7 @@ flexible messaging model and an intuitive client API.</description>
     <snappy.version>1.1.10.8</snappy.version> <!-- ZooKeeper server -->
     <dropwizardmetrics.version>4.1.12.1</dropwizardmetrics.version> <!-- ZooKeeper server -->
     <curator.version>5.7.1</curator.version>
-    <netty.version>4.1.139.Final</netty.version>
-    <netty-iouring.version>0.0.26.Final</netty-iouring.version>
+    <netty.version>4.2.19.Final</netty.version>
     <jetty.version>12.1.13</jetty.version>
     <!-- Jetty 9 is used in tiered-storage/file-system tests and pulsar-io/alluxio -->
     <jetty9.version>9.4.58.v20250814</jetty9.version>
@@ -262,7 +262,7 @@ flexible messaging model and an intuitive client API.</description>
     <prometheus-jmx.version>0.16.1</prometheus-jmx.version>
     <confluent.version>7.9.2</confluent.version>
     <aircompressor.version>2.0.3</aircompressor.version>
-    <asynchttpclient.version>2.16.1</asynchttpclient.version>
+    <asynchttpclient.version>3.0.14</asynchttpclient.version>
     <commons-lang3.version>3.19.0</commons-lang3.version>
     <commons-io.version>2.22.0</commons-io.version>
     <commons-codec.version>1.22.1</commons-codec.version>
@@ -306,7 +306,7 @@ flexible messaging model and an intuitive client API.</description>
     <!-- zstd-jni is only used for testcase,
     the core logic is switched to java implementation of zstd in org.apache.commons:commons-compress -->
     <zstd-jni.version>1.5.7-3</zstd-jni.version>
-    <netty-reactive-streams.version>2.0.6</netty-reactive-streams.version>
+    <netty-reactive-streams.version>2.0.20</netty-reactive-streams.version>
     <opentelemetry.version>1.62.0</opentelemetry.version>
     <opentelemetry.alpha.version>${opentelemetry.version}-alpha</opentelemetry.alpha.version>
     <opentelemetry.instrumentation.version>2.28.1</opentelemetry.instrumentation.version>
@@ -774,29 +774,6 @@ flexible messaging model and an intuitive client API.</description>
         <scope>import</scope>
       </dependency>
 
-      <dependency>
-        <groupId>io.netty.incubator</groupId>
-        <artifactId>netty-incubator-transport-classes-io_uring</artifactId>
-        <version>${netty-iouring.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>io.netty.incubator</groupId>
-        <artifactId>netty-incubator-transport-native-io_uring</artifactId>
-        <version>${netty-iouring.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>io.netty.incubator</groupId>
-        <artifactId>netty-incubator-transport-native-io_uring</artifactId>
-        <version>${netty-iouring.version}</version>
-        <classifier>linux-x86_64</classifier>
-      </dependency>
-      <dependency>
-        <groupId>io.netty.incubator</groupId>
-        <artifactId>netty-incubator-transport-native-io_uring</artifactId>
-        <version>${netty-iouring.version}</version>
-        <classifier>linux-aarch_64</classifier>
-      </dependency>
-
       <dependency>
         <groupId>info.picocli</groupId>
         <artifactId>picocli</artifactId>
@@ -2491,20 +2468,6 @@ flexible messaging model and an intuitive client API.</description>
   </build>
 
   <profiles>
-    <profile>
-      <!-- used for running integration tests on Java 8 -->
-      <id>integration-test-java8</id>
-      <activation>
-        <jdk>1.8</jdk>
-      </activation>
-      <properties>
-        <test.additional.args/>
-        <maven.compiler.source>8</maven.compiler.source>
-        <maven.compiler.target>8</maven.compiler.target>
-        <pulsar.broker.compiler.release/>
-        <pulsar.client.compiler.release/>
-      </properties>
-    </profile>
     <profile>
       <id>coverage</id>
       <properties>

pulsar-broker-auth-oidc/pom.xml

@@ -40,6 +40,12 @@
 
   <dependencies>
 
+    <!-- AHC 3.x loads HTTP/2 handlers even when HTTP/1.1 is used. -->
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-codec-http2</artifactId>
+    </dependency>
+
     <dependency>
       <groupId>${project.groupId}</groupId>
       <artifactId>pulsar-broker-common</artifactId>

pulsar-broker-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/oidc/AuthenticationProviderOpenID.java

@@ -47,6 +47,7 @@
 import java.security.PublicKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPublicKey;
+import java.time.Duration;
 import java.util.List;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
@@ -184,8 +185,8 @@ public void initialize(Context context) throws IOException {
         }
         AsyncHttpClientConfig clientConfig = new DefaultAsyncHttpClientConfig.Builder()
                 .setCookieStore(null)
-                .setConnectTimeout(connectionTimeout)
-                .setReadTimeout(readTimeout)
+                .setConnectTimeout(Duration.ofMillis(connectionTimeout))
+                .setReadTimeout(Duration.ofMillis(readTimeout))
                 .setSslContext(sslContext)
                 .build();
         httpClient = new DefaultAsyncHttpClient(clientConfig);

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/PulsarChannelInitializer.java

@@ -22,7 +22,6 @@
 import io.netty.channel.ChannelHandler;
 import io.netty.channel.ChannelInitializer;
 import io.netty.channel.socket.SocketChannel;
-import io.netty.handler.flow.FlowControlHandler;
 import io.netty.handler.flush.FlushConsolidationHandler;
 import io.netty.handler.ssl.SslHandler;
 import java.util.concurrent.TimeUnit;
@@ -36,6 +35,7 @@
 import org.apache.pulsar.common.protocol.OptionalProxyProtocolDecoder;
 import org.apache.pulsar.common.util.PulsarSslConfiguration;
 import org.apache.pulsar.common.util.PulsarSslFactory;
+import org.apache.pulsar.common.util.netty.PulsarFlowControlHandler;
 
 @Slf4j
 public class PulsarChannelInitializer extends ChannelInitializer<SocketChannel> {
@@ -98,7 +98,7 @@ protected void initChannel(SocketChannel ch) throws Exception {
         // as they like for any given input. so, disabling auto-read on `ByteToMessageDecoder` doesn't work properly and
         // ServerCnx ends up reading higher number of messages and broker can not throttle the messages by disabling
         // auto-read.
-        ch.pipeline().addLast("flowController", new FlowControlHandler());
+        ch.pipeline().addLast("flowController", new PulsarFlowControlHandler());
         // using "ChannelHandler" type to workaround an IntelliJ bug that shows a false positive error
         ChannelHandler cnx = newServerCnx(pulsar, listenerName);
         ch.pipeline().addLast("handler", cnx);

pulsar-client-admin/src/main/java/org/apache/pulsar/client/admin/internal/http/AsyncHttpConnector.java

@@ -157,16 +157,16 @@ private void configureAsyncHttpClientConfig(ClientConfigurationData conf, int co
             confBuilder.setAcquireFreeChannelTimeout(conf.getRequestTimeoutMs());
         }
         if (conf.getConnectionMaxIdleSeconds() > 0) {
-            confBuilder.setPooledConnectionIdleTimeout(conf.getConnectionMaxIdleSeconds() * 1000);
+            confBuilder.setPooledConnectionIdleTimeout(Duration.ofSeconds(conf.getConnectionMaxIdleSeconds()));
         }
         confBuilder.setCookieStore(null);
         confBuilder.setUseProxyProperties(true);
         confBuilder.setFollowRedirect(false);
-        confBuilder.setRequestTimeout(conf.getRequestTimeoutMs());
-        confBuilder.setConnectTimeout(connectTimeoutMs);
-        confBuilder.setReadTimeout(readTimeoutMs);
+        confBuilder.setRequestTimeout(Duration.ofMillis(conf.getRequestTimeoutMs()));
+        confBuilder.setConnectTimeout(Duration.ofMillis(connectTimeoutMs));
+        confBuilder.setReadTimeout(Duration.ofMillis(readTimeoutMs));
         confBuilder.setUserAgent(String.format("Pulsar-Java-v%s", PulsarVersion.getVersion()));
-        confBuilder.setRequestTimeout(requestTimeoutMs);
+        confBuilder.setRequestTimeout(Duration.ofMillis(requestTimeoutMs));
         confBuilder.setIoThreadsCount(conf.getNumIoThreads());
         confBuilder.setKeepAliveStrategy(new DefaultKeepAliveStrategy() {
             @Override

pulsar-client-messagecrypto-bc/pom.xml

@@ -34,6 +34,18 @@
   <name>Pulsar Client Messagecrypto BC</name>
 
   <dependencies>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-common</artifactId>
+      <scope>provided</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-buffer</artifactId>
+      <scope>provided</scope>
+    </dependency>
+
     <dependency>
       <groupId>${project.groupId}</groupId>
       <artifactId>pulsar-common</artifactId>

pulsar-client/pom.xml

@@ -32,6 +32,12 @@
   <name>Pulsar Client Java Original</name>
 
   <dependencies>
+
+    <!-- AHC 3.x loads HTTP/2 handlers even when HTTP/1.1 is used. -->
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-codec-http2</artifactId>
+    </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>
       <artifactId>pulsar-client-api</artifactId>

pulsar-client/src/main/java/org/apache/pulsar/client/impl/ControlledClusterFailover.java

@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
+import java.time.Duration;
 import java.util.Map;
 import java.util.Objects;
 import java.util.concurrent.ExecutionException;
@@ -98,8 +99,8 @@ private AsyncHttpClient buildHttpClient() {
         confBuilder.setUseProxyProperties(true);
         confBuilder.setFollowRedirect(true);
         confBuilder.setMaxRedirects(DEFAULT_MAX_REDIRECTS);
-        confBuilder.setConnectTimeout(DEFAULT_CONNECT_TIMEOUT_IN_SECONDS * 1000);
-        confBuilder.setReadTimeout(DEFAULT_READ_TIMEOUT_IN_SECONDS * 1000);
+        confBuilder.setConnectTimeout(Duration.ofSeconds(DEFAULT_CONNECT_TIMEOUT_IN_SECONDS));
+        confBuilder.setReadTimeout(Duration.ofSeconds(DEFAULT_READ_TIMEOUT_IN_SECONDS));
         confBuilder.setUserAgent(String.format("Pulsar-Java-v%s", PulsarVersion.getVersion()));
         confBuilder.setKeepAliveStrategy(new DefaultKeepAliveStrategy() {
             @Override