terrymanu commented on PR #40125: URL: https://github.com/apache/shardingsphere/pull/40125#issuecomment-6094243346
### Result **Review Result: Mergeable** Upgraded Netty from `4.2.9.Final` to `4.2.19.Final`, with the BOM updating tcnative to `2.0.84.Final`. Only two files and 24 version values changed to obtain upstream security fixes. ### Evidence - [pom.xml](/Users/zhangliang/IdeaProjects/shardingsphere/pom.xml:109) updates the shared version; [LICENSE](/Users/zhangliang/IdeaProjects/shardingsphere/distribution/proxy/src/main/release-docs/LICENSE:273) updates 23 entries. An independent audit confirmed that they match the actual distribution dependencies without omissions. - Using the modified POM, all 465 tests across 88 test classes passed, with zero failures, errors, or skips. The runtime classpath contained the updated dependencies. Existing compiled artifacts were reused; a full recompilation was not performed. - Only the 23 relevant dependencies changed. All other dependencies remained unchanged. The resolved dependency graph matches the preflight candidate, so the checks of 551 API references and the flow-control, TLS, and gRPC probes remain applicable. - POM Spotless, which checked exactly one file, the full RAT check, and the diff check all passed. The independent review found no issues. ### Coverage This is a standalone local candidate based on `f6bdd897b435`, which remains HEAD. The review covers all changes in the two files, including dependency compatibility, distribution licensing, and test execution. All three discovery lenses and the final convergence pass were completed, with no outstanding code findings. No defensive code or additional compatibility adaptations were introduced. Previously disclosed deployment conditions remain applicable; no additional platform compatibility guarantees are made. The result covers code readiness only; CI was not reviewed. Local formatting and license checks are complete. Checkstyle does not apply to these two files. Full E2E tests, a real etcd cluster, Linux epoll, and a complete OWASP scan were not run. Native TLS on older Intel Macs was not tested. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
