xiangfu0 opened a new pull request, #19828: URL: https://github.com/apache/pinot/pull/19828
Reactor Netty 1.2.18 has newly reported client [DNS](https://spring.io/security/cve-2026-47843/) and [WebSocket](https://spring.io/security/cve-2026-47848/) vulnerabilities whose public fixes require Reactor Netty 1.3.7 and Netty 4.2. Upgrade both managed versions and retain Pinot's existing certificate-trust behavior for internal client TLS contexts. Netty 4.2 also changes event loop shutdown ordering with zero grace time. An accepted query connection registered after shutdown begins can remain open after worker termination, leaving the broker waiting for its query timeout. Mark query-server shutdown before closing the listener, close tracked children, and reject late accepted children. ### Reproduction With the version upgrade alone, existing `QueryRoutingTest.testNonMatchingRequestId` followed by `testServerDown` reproduces the missing early termination. The full routing test sequence passes on 4.1.139 and fails on 4.2.18 before the shutdown fix. A peerless internal TLS handler also fails because 4.2 defaults to HTTPS endpoint identification. ```bash ./mvnw -pl pinot-core -am -Dnetty.version=4.2.18.Final -Dreactor-netty.version=1.3.7 \ -Dtest=QueryRoutingTest#testNonMatchingRequestId+testServerDown \ -Dsurefire.failIfNoSpecifiedTests=false test ``` On master before this change, the early-termination assertion fails; with the fix, both tests pass. ### Validation - Maven wrapper/JDK 25: `TlsUtilsTest`, `NettyTest`, `ServerChannelsTest`, `QueryServerTest`, and `QueryRoutingTest`: 29 passed, one Linux-only skip on macOS, zero failures/errors. The final routing class runs in 4.4 seconds; `testServerDown` terminates in 25 ms. - Fresh 64-module source reactor build and three existing `TlsIntegrationTest` methods passed: trusted server, untrusted server, and TLS pre-connect to every server. - A direct probe of the patched peerless Pinot TLS handler completes its trusted handshake; the context retains its configured key/trust managers. - Root/common/core license, Spotless and Checkstyle checks pass. No tests or benchmarks added. The TLS fixture logs an invalid logical-table time-boundary configuration during setup; the three selected physical-table TLS assertions pass. This validation does not claim clean fixture logs or complete logical-table coverage. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
