rzo1 opened a new pull request, #2320: URL: https://github.com/apache/stormcrawler/pull/2320
Upgrades to [Apache Storm 3.2.0](https://storm.apache.org/2026/11/10/storm320-released.html), which fixes three CVEs. - `storm-client` 3.2.0, also in the three archetypes and the READMEs - Jackson 2.22.4, in line with Storm 3.2.0 - `storm.metrics.reporters` was removed in 3.2.0 (it's now ignored with a warning), so the `MetricsReporter` javadocs of OpenSearch, Solr and SQL now show `topology.metrics.reporters` **THIRD-PARTY.txt** The modules resolved different versions of the same artifacts (5 of slf4j-api, 3 of netty, guava 18 in langid, ...). slf4j-api, guava, commons-io, commons-logging, gson, error_prone_annotations, jspecify and netty are now pinned in `dependencyManagement`. Storm 3.2.0 ships netty, slf4j-api, commons-io and jspecify unshaded in `lib-common`, ahead of the topology jar, so those follow the versions of the Storm distribution (netty 4.2.19 rather than the 4.1.x the AWS SDK and Solr asked for). I checked that language-detector 0.6 only calls Guava methods that still exist in 33.8. Also added the license name variants that weren't merged yet. | | main | this PR | |---|---:|---:| | Entries | 289 | 260 | | License headings | 26 | 20 | | Artifacts in more than one version | 17 | 1 (protobuf-java: 3.25.8 for urlfrontier, 4.36.1 is Storm's provided only) | `mvn clean install`: 2,307 tests, all passing. The docker-compose files keep `storm:latest`, since there's no 3.2.0 image on Docker Hub yet. A follow-up will mark the libraries Storm ships in `lib-common` as provided. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
