vlsi commented on issue #6714: URL: https://github.com/apache/jmeter/issues/6714#issuecomment-4796645568
Thanks for the report. A quick check on the `release/5.6.x` branch (and on the `rel/v5.6.3` baseline) shows that **JMeter does not ship any netty jar**: ``` $ grep -i netty src/dist/src/dist/expected_release_jars.csv (no matches) $ ./gradlew :src:protocol:bolt:dependencies --configuration runtimeClasspath | grep netty (no matches) ``` The bolt protocol module uses `neo4j-java-driver:4.4.13`, which still ships the legacy non-netty transport. Netty only entered JMeter's dependency tree on `master`, where `neo4j-java-driver` was bumped to 6.x — and master carries `netty 4.2.7.Final`, not the 4.1.118 / 4.1.135 / 4.1.133 versions mentioned in the report. Could you confirm: - which artifact you scanned (a stock `apache-jmeter-5.6.3.tgz` or an installation extended with third-party plugins), - which plugins are deployed in `lib/ext/`? If netty shows up via a plugin (jmeter-plugins, Pulsar, Kafka, gRPC, MQTT, etc.), the fix needs to come from that plugin's vendor; JMeter core has no leverage over the netty version pulled by an external plugin. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
