RockteMQ-AI commented on issue #1313: URL: https://github.com/apache/rocketmq-clients/issues/1313#issuecomment-5088278385
**Issue Evaluation** Category: `type/enhancement` | Status: **Evaluated** **Feasibility:** needs-discussion **Scope:** `java` module — `grpc-netty-shaded` dependency chain **Compatibility:** Potential breaking changes from gRPC upgrade **Analysis:** The Netty dependency in `rocketmq-client-java` is pulled in transitively through `grpc-netty-shaded` (currently at gRPC `1.50.0`, which bundles Netty ~`4.1.79.Final`). There is no direct `netty` dependency in the client pom — upgrading Netty independently is not straightforward because `grpc-netty-shaded` repackages Netty classes into its own JAR. To reach Netty `4.1.136.Final`, the `grpc.version` would need to be bumped from `1.50.0` (Oct 2022) to a much newer release. This is a significant upgrade that may introduce: - gRPC API changes affecting client internals - Behavioral differences in retry, load-balancing, or connection management - Compatibility risk with the Proxy-side gRPC protocol version For reference, the main `apache/rocketmq` repo already uses Netty `4.1.130.Final` directly. **Recommendation:** This is a valid security concern. A gRPC version bump should be evaluated holistically — testing against the Proxy gRPC protocol, verifying retry/fault-tolerance behavior, and coordinating with the `apache/rocketmq` Proxy module to ensure protocol compatibility. Marking as `needs-discussion` for maintainer input on the gRPC upgrade scope. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
