spuru9 opened a new pull request, #171:
URL: https://github.com/apache/flink-shaded/pull/171
## What
Bump the bundled Netty on the `release-20.0` line from `4.1.135.Final`
(#165) to `4.1.136.Final`, and update the affected `NOTICE` files to match the
newly bundled versions.
## Why
`4.1.136.Final` fixes several Netty CVEs reported against `4.1.135.Final` in
`netty-codec-dns`, `netty-codec-haproxy`, and `netty-codec-stomp`. Because
`flink-shaded` bundles (relocates) Netty, consumers of `flink-shaded-netty` /
`flink-shaded-zookeeper-3` can only pick up these fixes via a rebuild of the
shaded artifacts from a bumped source branch — the bundled copy is invisible to
downstream `dependencyManagement`.
## Changes
- **`pom.xml`** — `netty.version` `4.1.135.Final` → `4.1.136.Final`.
- **`flink-shaded-netty-4/src/main/resources/META-INF/NOTICE`** — bundled
`io.netty:*` version lines → `4.1.136.Final`.
-
**`flink-shaded-zookeeper-{35,36,37,38}/src/main/resources/META-INF/NOTICE`** —
the bundled `io.netty:*` lines → `4.1.136.Final`. These modules import
`io.netty:netty-bom:${netty.version}` in `dependencyManagement`, so the bump
changes the Netty they bundle too; their NOTICE files must track it or
`check-license` fails.
The `netty-bom` module set is identical between `4.1.135.Final` and
`4.1.136.Final` (verified against Maven Central), so no NOTICE entries are
added or removed beyond the version string — a clean substitution, unlike #165
which also added a new `linux-riscv64` classifier entry.
`netty.tcnative.version` (`2.0.62.Final`) is a separate property and is
intentionally left unchanged.
## Verification
Built locally with Maven 3.9.4 / Java 21 (`-Denforcer.skip -Drat.skip`,
since this environment doesn't match the release profile's pinned Java 8 /
Maven 3.8.6):
- `mvn -pl flink-shaded-netty-4 -am package` — `BUILD SUCCESS`;
`flink-shaded-netty-4.1.136.Final-20.0.jar` bundles
`netty-all.version=4.1.136.Final`, keeps the
`org.apache.flink.shaded.netty4.io.netty` relocation, and the NOTICE lists
`io.netty:netty-codec-dns`, `netty-codec-haproxy`, and `netty-codec-stomp` all
at `4.1.136.Final`.
- `mvn -pl flink-shaded-zookeeper-parent/flink-shaded-zookeeper-38 -am
package` — `BUILD SUCCESS`, confirming the shared `netty-bom` import resolves
cleanly for the zookeeper modules too.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (claude-sonnet-5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
