Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chores(deps): Bump armeria.version from 1.17.2 to 1.24.3 #3557

Closed
wants to merge 2 commits into from

Conversation

darkmastermindz
Copy link
Contributor

Resolves CVE-2023-38493 (Issue #3556)
Bump netty.version to align to latest
Bump jackson.version to align to latest
Bump micrometer.version to align to latest

Ref: https://netty.io/news/2023/07/27/4-1-96-Final.html https://mvnrepository.com/artifact/com.linecorp.armeria/armeria/1.24.3

Resolves CVE-2023-38493 (Issue openzipkin#3556)
Bump netty.version to align to latest
Bump jackson.versio to align to latest
Bump micrometer.version to align to latest

Ref: https://netty.io/news/2023/07/27/4-1-96-Final.html
https://mvnrepository.com/artifact/com.linecorp.armeria/armeria/1.24.3
@darkmastermindz
Copy link
Contributor Author

darkmastermindz commented Aug 9, 2023

Looks like the time elapsed was 3.054 seconds which is 0.054s more than the test expectations. Not sure if this still in acceptable range.

/** blocking a little is ok, but blocking forever is not. */
@Test(timeout = 3000L) public void doesntHangWhenAllDown() throws IOException {
TestPropertyValues.of(
"spring.config.name=zipkin-server",
"zipkin.storage.type:elasticsearch",
"zipkin.storage.elasticsearch.timeout:1000",
"zipkin.storage.elasticsearch.hosts:127.0.0.1:1234,127.0.0.1:5678")
.applyTo(context);
Access.registerElasticsearch(context);
context.refresh();
try (ElasticsearchStorage storage = context.getBean(ElasticsearchStorage.class)) {
CheckResult result = storage.check();
assertThat(result.ok()).isFalse();
}
}

@darkmastermindz
Copy link
Contributor Author

@llinder could you please review, thanks!

Bumps [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) from 3.14.0 to 3.16.3.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](protocolbuffers/protobuf@v3.14.0...v3.16.3)

---
updated-dependencies:
- dependency-name: com.google.protobuf:protobuf-java
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@darkmastermindz
Copy link
Contributor Author

darkmastermindz commented Aug 14, 2023

Trying to see if bumping protobuf CVE issue will help with benchmarks

@debraj-manna
Copy link

Can someone let me know when is this expected to be merged?

@codefromthecrypt
Copy link
Member

I will be helping with all this stuff this week. Sorry about the neglect experience. let's work together to fix it.

@darkmastermindz are you running a zipkin site or is this a hobby effort for you?

@codefromthecrypt
Copy link
Member

@debraj-manna the project team basically haven't been working out well as this has proven out. I'm going to clean as much of the PR queue as I can, and later raise an issue to help build an on-ramp for new maintainers, who have stake in PRs landing, especially ones like this. Apologies on behalf of this accidental situation... basically I think all the historical maintainers aren't running sites anymore and this is a problem to fix.

@codefromthecrypt
Copy link
Member

ps if you'd like to rebase with latest armeria (make sure affected versions also match armeria), go for it. Otherwise, I'll help with your branch tomorrow. We'll get this sorted by tomorrow either way.

@codefromthecrypt
Copy link
Member

working on this now

@codefromthecrypt
Copy link
Member

I don't have write access to your branch, so I pulled the change into #3614. I dropped the protobuf update as it only affected benchmarks (not production code). I'll update proto in a different PR to latest along with any other deps only used in benchmarks. Thanks again for the help!

@darkmastermindz
Copy link
Contributor Author

I will be helping with all this stuff this week. Sorry about the neglect experience. let's work together to fix it.

@darkmastermindz are you running a zipkin site or is this a hobby effort for you?

@codefromthecrypt Thanks for the help on this! Apologies for the unresponsiveness as I've been on holiday. This is mostly has become a hobby effort. Previously, I was running zipkin site for an Enterprise organization. Generally, I'm open in helping contribute and help maintain open source telemetry projects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants