spuru9 opened a new pull request, #174: URL: https://github.com/apache/flink-shaded/pull/174
## What JIRA: https://issues.apache.org/jira/browse/FLINK-41076 (relates to FLINK-39570) Bump the bundled Netty on the `release-21.0` line from `4.2.6.Final` to `4.2.17.Final`, and update the affected `NOTICE` files to match. ## Why `4.2.17.Final` is the current `4.2.x` release and carries the Netty security fixes published after `4.2.6.Final` (fixed in `4.2.10`/`4.2.11`/`4.2.15`/`4.2.16`/`4.2.17`), in `netty-codec-http`, `netty-codec-http2`, `netty-handler`, `netty-resolver-dns`, `netty-codec-dns`, `netty-codec-haproxy` and `netty-codec-stomp`. Because `flink-shaded` bundles (relocates) Netty, consumers of `flink-shaded-netty` / `flink-shaded-zookeeper-3` can only pick up these fixes via a rebuild of the shaded artifacts from a bumped source branch — the bundled copy is invisible to downstream `dependencyManagement`. This is the 21.0 counterpart of #165 and #171 (`release-20.0`, Netty 4.1.135 / 4.1.136). It is a patch bump within the same `4.2.x` line already used by `release-21.0`. ## Changes - **`pom.xml`** — `netty.version` `4.2.6.Final` → `4.2.17.Final`. - **`flink-shaded-netty-4/src/main/resources/META-INF/NOTICE`** — bundled `io.netty:*` version lines → `4.2.17.Final` (50 lines). - **`flink-shaded-zookeeper-{35,36,37,38}/src/main/resources/META-INF/NOTICE`** — the bundled `io.netty:*` lines (9 per module) → `4.2.17.Final`. These modules import `io.netty:netty-bom:${netty.version}` in `dependencyManagement`, so the bump changes the Netty they bundle too; their NOTICE files must track it or `check-license` fails. No NOTICE entries are added or removed beyond the version string: the 50 `io.netty` artifacts bundled by `flink-shaded-netty-4` (from the shade plugin's `Including …` output) match the NOTICE list exactly. `netty.tcnative.version` is a separate property and is intentionally left unchanged. ## Verification Built locally with Maven 3.9.4 / Java 21 against Maven Central, `mvn clean deploy -Plicense-check -Pinclude-netty-tcnative-static` on `flink-shaded-netty-4` and `flink-shaded-zookeeper-{35,36,37,38}` (with `-am`): - `BUILD SUCCESS` for all 7 modules in the reactor. - `LicenseChecker` (`exec:java@check-license`): "License check completed without severe issues." - `flink-shaded-netty-4-4.2.17.Final-21.0.jar`: `META-INF/io.netty.versions.properties` reports `4.2.17.Final`, 3513 classes under `org/apache/flink/shaded/netty4/io/netty`, 0 un-relocated `io/netty` classes. - zookeeper 3.5–3.8 jars still bundle relocated Netty. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (claude-sonnet-5-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
