fuyou001 commented on PR #10695: URL: https://github.com/apache/rocketmq/pull/10695#issuecomment-5128557691
The selected versions are valid upstream security releases and the upgrade direction looks correct. However, this PR currently reports no checks and contains no test evidence, so please add compatibility validation before merging. `fastjson2` 2.0.63 includes behavior changes beyond AutoType hardening, including reference detection for collection elements and JSON/JSONB parser changes. Please run the full JDK 8 build and unit-test suite and add focused compatibility tests for RocketMQ configuration, route data, ACL data, message metadata, and any persisted JSON/JSONB representations. The required upgrade matrix should include old-version write/new-version read, new-version write/old-version read, existing persisted data followed by restart/recovery, malformed or truncated input, and rolling upgrade/downgrade. Please also exercise AutoType enabled/disabled, safe mode enabled/disabled, and custom accept/deny configurations. These assertions are especially important because this is a dependency-management change affecting all modules rather than a single isolated call path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
