morningman opened a new pull request, #68862: URL: https://github.com/apache/doris/pull/68862
### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: FE pins Spring Boot 3.5.16 and Spring Framework 6.2.19 after their OSS support has ended. For [CVE-2026-47883](https://spring.io/security/cve-2026-47883/), [CVE-2026-47889](https://spring.io/security/cve-2026-47889/) and [CVE-2026-47890](https://spring.io/security/cve-2026-47890/), the Framework 6.2 fixes are available only in enterprise-supported 6.2.20, while the OSS fixes are in 7.0.9. Keeping the final OSS 6.2 release leaves this dependency without an OSS security update path. This PR upgrades Boot to 4.1.1, Framework to 7.0.9, Spring LDAP to 4.1.1 and Jetty to 12.1.14 with Servlet 6.1 / EE11, retaining Java 17. It adapts the Boot API packages and replaces the removed optional trailing-slash matching with request wrapping before MVC routing and authentication. Boot's Jackson 2 compatibility module preserves existing HTTP JSON responses; SnakeYAML is aligned with the Boot generation and the obsolete Tomcat EL override is removed. It also removes unused direct AWS SDK v1 and cglib dependencies and excludes the Hadoop YARN client that brings Jetty 9 WebSocket jars into FE. The Trino connector's existing Jetty 11 HTTP/2 client dependencies remain pinned and require a separate upstream-client migration. ### Release note Update the FE Spring and Jetty dependencies to supported OSS releases and remove unused end-of-support libraries while preserving HTTP authentication, JSON responses, cookies and trailing-slash URLs. ### Check List (For Author) - Test - [ ] Regression test - [x] Unit Test - [x] Manual test (artifact dependency inspection, steps below) - [ ] No need to test or manual test. Explain why: - [ ] This is a refactor/code format and no logic has been changed. - [ ] Previous test can cover this change. - [ ] No code files have been changed. - [ ] Other reason Validation: - Run `run-fe-ut.sh` for HTTP, Web SQL, LDAP, S3 credentials/storage and Trino connector cases: **384 tests across 36 classes, 382 passed, 2 skipped**. The skipped S3 cases require external credentials/configuration that were not supplied. FE core, LDAP plugin and Trino/LDAP nested suites were validated in separate invocations. - Add 5 tests against a real embedded Jetty server for JSON/date serialization, POST bodies and query parameters, SameSite/HttpOnly cookies, authentication, trailing-slash URLs and the root path. Existing FE HTTP end-to-end tests and 13 embedded-LDAP authentication tests also pass. - Build with Checkstyle enabled and the Maven build cache disabled: ```bash EXTRA_FE_MODULES='ldap=fe-authentication/fe-authentication-plugins/fe-authentication-plugin-ldap' \ DISABLE_BUILD_UI=ON FE_MAVEN_THREADS=4 \ MVN_OPT='-B -ntp -o -Dmaven.build.cache.enabled=false' \ bash build.sh --fe --output output/fe-supported-dependencies ``` - Inspect `dependency:tree -Dscope=runtime` and the packaged FE/plugin jars. Packaged FE core and provider plugins contain no AWS SDK v1, cglib or Jetty 9 WebSocket jars. Trino's remaining Jetty 11 HTTP/2 client jars are recorded above. - SQL regression suites were not run; this change targets web dependencies and HTTP compatibility. - Behavior changed: - [ ] No. - [x] Yes. Upgrade the web stack and normalize trailing slashes without HTTP redirects; retain existing HTTP contracts. - Does this need documentation? - [x] No. No configuration or Java baseline changes are required. - [ ] Yes. ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
