This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/helix.git
commit e02be4c729da50ec276b2d823aaee0485dc05442 Author: Junkai Xue <[email protected]> AuthorDate: Wed Nov 11 08:55:25 2026 -0800 Upgrade ZooKeeper from 3.9.3 to 3.9.5 3.9.4 and 3.9.5 fix GHSA-2hmj-97jw-28jh (insufficient permission check in the AdminServer snapshot/restore commands), GHSA-crhr-qqj8-rpxc (improper handling of configuration values) and GHSA-7xrh-hqfc-g7qr (reverse-DNS fallback allows a hostname verification bypass in ZKTrustManager). 3.9.4 also fixes ZOOKEEPER-4921, a 3.9.3 client that fails to reconnect after network failures. No Helix source changes are needed. Between the two jars one class is added (common.ConfigException) and one internal server class is removed; the KeeperException codes are the same. ZooKeeper itself moved to slf4j 2.0.13 in 3.9.4, but it only uses Logger, LoggerFactory and MDC, and Helix keeps managing slf4j-api at 1.7.32, so the resolved logging stack is unchanged. Only netty-codec was managed in the root pom, which left it at 4.1.136 next to the other netty artifacts at the version ZooKeeper brings (4.1.130 now, 4.1.113 before). The netty BOM is imported instead, so all of them resolve to 4.1.136. The ZooKeeper revision in the checked-in ivy files is updated. --- helix-core/helix-core-2.0.2-SNAPSHOT.ivy | 2 +- .../org/apache/helix/metaclient/impl/zk/util/ZkMetaClientUtil.java | 2 +- pom.xml | 6 +++++- zookeeper-api/pom.xml | 2 +- zookeeper-api/zookeeper-api-2.0.2-SNAPSHOT.ivy | 2 +- 5 files changed, 9 insertions(+), 5 deletions(-) diff --git a/helix-core/helix-core-2.0.2-SNAPSHOT.ivy b/helix-core/helix-core-2.0.2-SNAPSHOT.ivy index e3b468a96..3d2f72bdf 100755 --- a/helix-core/helix-core-2.0.2-SNAPSHOT.ivy +++ b/helix-core/helix-core-2.0.2-SNAPSHOT.ivy @@ -52,7 +52,7 @@ under the License. <dependency org="org.apache.logging.log4j" name="log4j-slf4j-impl" rev="2.17.1" force="true" conf="compile->compile(*),master(*);runtime->runtime(*)"> <artifact name="log4j-slf4j-impl" ext="jar"/> </dependency> - <dependency org="org.apache.zookeeper" name="zookeeper" rev="3.9.3" conf="compile->compile(default);runtime->runtime(default);default->default"/> + <dependency org="org.apache.zookeeper" name="zookeeper" rev="3.9.5" conf="compile->compile(default);runtime->runtime(default);default->default"/> <dependency org="com.fasterxml.jackson.core" name="jackson-databind" rev="2.12.6.1" conf="compile->compile(default);runtime->runtime(default);default->default"/> <dependency org="com.fasterxml.jackson.core" name="jackson-core" rev="2.12.6" conf="compile->compile(default);runtime->runtime(default);default->default"/> <dependency org="commons-io" name="commons-io" rev="2.11.0" conf="compile->compile(default);runtime->runtime(default);default->default"/> diff --git a/meta-client/src/main/java/org/apache/helix/metaclient/impl/zk/util/ZkMetaClientUtil.java b/meta-client/src/main/java/org/apache/helix/metaclient/impl/zk/util/ZkMetaClientUtil.java index f1693dbba..298d69da7 100644 --- a/meta-client/src/main/java/org/apache/helix/metaclient/impl/zk/util/ZkMetaClientUtil.java +++ b/meta-client/src/main/java/org/apache/helix/metaclient/impl/zk/util/ZkMetaClientUtil.java @@ -277,7 +277,7 @@ public class ZkMetaClientUtil { /** * This function translate and group Zk exception code to metaclient code. - * It currently includes all ZK code on 3.9.3. + * It currently includes all ZK code on 3.9.5. */ public static MetaClientException.ReturnCode translateZooKeeperCodeToMetaClientCode( KeeperException.Code zkCode) { diff --git a/pom.xml b/pom.xml index 4ebe848aa..4f2be12cf 100644 --- a/pom.xml +++ b/pom.xml @@ -559,9 +559,13 @@ <version>3.12.4</version> </dependency> <dependency> + <!-- Keeps all the netty artifacts that come in through ZooKeeper at the same version; + netty does not support mixing versions. --> <groupId>io.netty</groupId> - <artifactId>netty-codec</artifactId> + <artifactId>netty-bom</artifactId> <version>4.1.136.Final</version> + <type>pom</type> + <scope>import</scope> </dependency> </dependencies> </dependencyManagement> diff --git a/zookeeper-api/pom.xml b/zookeeper-api/pom.xml index a46f87a94..86f06944b 100644 --- a/zookeeper-api/pom.xml +++ b/zookeeper-api/pom.xml @@ -64,7 +64,7 @@ <dependency> <groupId>org.apache.zookeeper</groupId> <artifactId>zookeeper</artifactId> - <version>3.9.3</version> + <version>3.9.5</version> <exclusions> <exclusion> <groupId>junit</groupId> diff --git a/zookeeper-api/zookeeper-api-2.0.2-SNAPSHOT.ivy b/zookeeper-api/zookeeper-api-2.0.2-SNAPSHOT.ivy index cecff16bc..0d500919e 100644 --- a/zookeeper-api/zookeeper-api-2.0.2-SNAPSHOT.ivy +++ b/zookeeper-api/zookeeper-api-2.0.2-SNAPSHOT.ivy @@ -43,7 +43,7 @@ under the License. <dependency org="org.apache.logging.log4j" name="log4j-slf4j-impl" rev="2.17.1" force="true" conf="compile->compile(*),master(*);runtime->runtime(*)"> <artifact name="log4j-slf4j-impl" ext="jar"/> </dependency> - <dependency org="org.apache.zookeeper" name="zookeeper" rev="3.9.3" conf="compile->compile(default);runtime->runtime(default);default->default"/> + <dependency org="org.apache.zookeeper" name="zookeeper" rev="3.9.5" conf="compile->compile(default);runtime->runtime(default);default->default"/> <dependency org="com.fasterxml.jackson.core" name="jackson-databind" rev="2.12.6.1" force="true" conf="compile->compile(*),master(*);runtime->runtime(*)"/> <dependency org="com.fasterxml.jackson.core" name="jackson-core" rev="2.12.6" force="true" conf="compile->compile(*),master(*);runtime->runtime(*)"/> <dependency org="commons-cli" name="commons-cli" rev="1.2" force="true" conf="compile->compile(*),master(*);runtime->runtime(*)"/>
