[
https://issues.apache.org/jira/browse/HADOOP-20070?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139552#comment-18139552
]
ASF GitHub Bot commented on HADOOP-20070:
-----------------------------------------
pjfanning commented on PR #8943:
URL: https://github.com/apache/hadoop/pull/8943#issuecomment-6682823904
> Can we make a pruning before upgrading? For example, I don't think hadoop
uses `netty-codec-redis`. And upgrading should go trunk only, pruning can
backport to at least branch-3.5
I would prefer if there was a regular task of taking the binary tar.gz and
checking its jars against the LICENSE-binary as opposed to micromanaging it at
the PR level. The LICENSE-binary file already appears to have lots of out of
date entries and presumably also plenty of missing entries.
> upgrade to netty 4.2.20
> -----------------------
>
> Key: HADOOP-20070
> URL: https://issues.apache.org/jira/browse/HADOOP-20070
> Project: Hadoop Common
> Issue Type: Task
> Reporter: PJ Fanning
> Priority: Major
> Labels: pull-request-available
>
> https://netty.io/news/2026/11/02/4-2-20-Final.html includes a large number of
> CVE fixes.
> So far, Hadoop has stuck with Netty 4.1.x is approaching EOL - the middle of
> 2027.
> Upgrading from 4.1 has been straightforward where I've done this before (eg
> Apache Pekko).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
