abhijeet2096 opened a new pull request, #165:
URL: https://github.com/apache/flink-shaded/pull/165
## What
Bump the bundled Netty on the `release-20.0` line from `4.1.100.Final` to
`4.1.135.Final`, and update the affected `NOTICE` files to match the newly
bundled versions.
## Why
`4.1.135.Final` is the current 4.1.x maintenance release carrying the latest
Netty security fixes. Because `flink-shaded` bundles (relocates) Netty,
consumers of `flink-shaded-netty` can only pick up these fixes via a rebuild of
the shaded artifact from a bumped source branch — the bundled copy is invisible
to downstream `dependencyManagement`.
## Changes
- **`pom.xml`** — `netty.version` `4.1.100.Final` → `4.1.135.Final`.
- **`flink-shaded-netty-4/src/main/resources/META-INF/NOTICE`** — 34 bundled
`io.netty:*` version lines → `4.1.135.Final`.
-
**`flink-shaded-zookeeper-{35,36,37,38}/src/main/resources/META-INF/NOTICE`** —
the bundled `io.netty:*` lines (9 per module) → `4.1.135.Final`. These modules
import `io.netty:netty-bom:${netty.version}` in `dependencyManagement`, so the
bump changes the Netty they bundle too; their NOTICE files must track it or the
`check-license` step fails.
`netty.tcnative.version` (`2.0.62.Final`) is a separate property and is
intentionally left unchanged.
## Verification
Built with Java 8 / Maven 3.8.6 (`mvn clean deploy
-Pinclude-netty-tcnative-static -Plicense-check` equivalent reactor):
- `BUILD SUCCESS` across all 17 modules.
- Produced `flink-shaded-netty` bundles `netty-all.version=4.1.135.Final`,
keeps the `org/apache/flink/shaded/netty4/io/netty` relocation, and shows no
un-relocated `io/netty` leakage.
- Produced `flink-shaded-zookeeper-3` jars bundle Netty `4.1.135.Final`,
matching their updated NOTICE.
---
> **Draft** — opening for early review. A `FLINK-` JIRA still needs to be
filed and the title/commit updated to the `[FLINK-XXXXX]` convention before
this is ready to merge.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
