From 591550b16b8000478ea6bf28add948b3b02e5892 Mon Sep 17 00:00:00 2001 From: Enrico Olivelli Date: Sun, 27 Mar 2022 11:58:51 +0200 Subject: [PATCH 1/6] Upgrade ZooKeeper to 3.8.0 --- .../src/main/resources/LICENSE-all.bin.txt | 8 +++---- .../src/main/resources/LICENSE-bkctl.bin.txt | 8 +++---- .../src/main/resources/LICENSE-server.bin.txt | 8 +++---- dependencies.gradle | 2 +- pom.xml | 22 +++++-------------- 5 files changed, 18 insertions(+), 30 deletions(-) diff --git a/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt b/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt index 927ccbbaf8b..9b7d9c8214c 100644 --- a/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt +++ b/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt @@ -250,9 +250,9 @@ Apache Software License, Version 2. - lib/net.java.dev.jna-jna-3.2.7.jar [18] - lib/org.apache.commons-commons-collections4-4.1.jar [19] - lib/org.apache.commons-commons-lang3-3.6.jar [20] -- lib/org.apache.zookeeper-zookeeper-3.6.2.jar [21] -- lib/org.apache.zookeeper-zookeeper-jute-3.6.2.jar [21] -- lib/org.apache.zookeeper-zookeeper-3.6.2-tests.jar [21] +- lib/org.apache.zookeeper-zookeeper-3.8.0.jar [21] +- lib/org.apache.zookeeper-zookeeper-jute-3.8.0.jar [21] +- lib/org.apache.zookeeper-zookeeper-3.8.0-tests.jar [21] - lib/org.eclipse.jetty-jetty-http-9.4.43.v20210629.jar [22] - lib/org.eclipse.jetty-jetty-io-9.4.43.v20210629.jar [22] - lib/org.eclipse.jetty-jetty-security-9.4.43.v20210629.jar [22] @@ -329,7 +329,7 @@ Apache Software License, Version 2. [18] Source available at https://github.com/java-native-access/jna/tree/3.2.7 [19] Source available at https://git-wip-us.apache.org/repos/asf?p=commons-collections.git;a=tag;h=a3a5ad [20] Source available at https://git-wip-us.apache.org/repos/asf?p=commons-lang.git;a=shortlog;h=refs/tags/LANG_3_6 -[21] Source available at https://github.com/apache/zookeeper/tree/release-3.6.2 +[21] Source available at https://github.com/apache/zookeeper/tree/release-3.8.0 [22] Source available at https://github.com/eclipse/jetty.project/tree/jetty-9.4.43.v20210629 [23] Source available at https://github.com/facebook/rocksdb/tree/v6.22.1 [24] Source available at https://github.com/cbeust/jcommander/tree/1.78 diff --git a/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt b/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt index 45e7c1a04cc..b3cfe2f8db3 100644 --- a/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt +++ b/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt @@ -239,9 +239,9 @@ Apache Software License, Version 2. - lib/net.java.dev.jna-jna-3.2.7.jar [17] - lib/org.apache.commons-commons-collections4-4.1.jar [18] - lib/org.apache.commons-commons-lang3-3.6.jar [19] -- lib/org.apache.zookeeper-zookeeper-3.6.2.jar [20] -- lib/org.apache.zookeeper-zookeeper-jute-3.6.2.jar [20] -- lib/org.apache.zookeeper-zookeeper-3.6.2-tests.jar [20] +- lib/org.apache.zookeeper-zookeeper-3.8.0.jar [20] +- lib/org.apache.zookeeper-zookeeper-jute-3.8.0.jar [20] +- lib/org.apache.zookeeper-zookeeper-3.8.0-tests.jar [20] - lib/com.beust-jcommander-1.78.jar [23] - lib/net.jpountz.lz4-lz4-1.3.0.jar [25] - lib/com.google.api.grpc-proto-google-common-protos-2.0.1.jar [27] @@ -301,7 +301,7 @@ Apache Software License, Version 2. [17] Source available at https://github.com/java-native-access/jna/tree/3.2.7 [18] Source available at https://git-wip-us.apache.org/repos/asf?p=commons-collections.git;a=tag;h=a3a5ad [19] Source available at https://git-wip-us.apache.org/repos/asf?p=commons-lang.git;a=shortlog;h=refs/tags/LANG_3_6 -[20] Source available at https://github.com/apache/zookeeper/tree/release-3.6.2 +[20] Source available at https://github.com/apache/zookeeper/tree/release-3.8.0 [23] Source available at https://github.com/cbeust/jcommander/tree/1.78 [25] Source available at https://github.com/lz4/lz4-java/tree/1.3.0 [27] Source available at https://github.com/googleapis/googleapis diff --git a/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt b/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt index 4abfbc2920b..5e9656af5ed 100644 --- a/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt +++ b/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt @@ -250,9 +250,9 @@ Apache Software License, Version 2. - lib/net.java.dev.jna-jna-3.2.7.jar [18] - lib/org.apache.commons-commons-collections4-4.1.jar [19] - lib/org.apache.commons-commons-lang3-3.6.jar [20] -- lib/org.apache.zookeeper-zookeeper-3.6.2.jar [21] -- lib/org.apache.zookeeper-zookeeper-jute-3.6.2.jar [21] -- lib/org.apache.zookeeper-zookeeper-3.6.2-tests.jar [21] +- lib/org.apache.zookeeper-zookeeper-3.8.0.jar [21] +- lib/org.apache.zookeeper-zookeeper-jute-3.8.0.jar [21] +- lib/org.apache.zookeeper-zookeeper-3.8.0-tests.jar [21] - lib/org.eclipse.jetty-jetty-http-9.4.43.v20210629.jar [22] - lib/org.eclipse.jetty-jetty-io-9.4.43.v20210629.jar [22] - lib/org.eclipse.jetty-jetty-security-9.4.43.v20210629.jar [22] @@ -327,7 +327,7 @@ Apache Software License, Version 2. [18] Source available at https://github.com/java-native-access/jna/tree/3.2.7 [19] Source available at https://git-wip-us.apache.org/repos/asf?p=commons-collections.git;a=tag;h=a3a5ad [20] Source available at https://git-wip-us.apache.org/repos/asf?p=commons-lang.git;a=shortlog;h=refs/tags/LANG_3_6 -[21] Source available at https://github.com/apache/zookeeper/tree/release-3.6.2 +[21] Source available at https://github.com/apache/zookeeper/tree/release-3.8.0 [22] Source available at https://github.com/eclipse/jetty.project/tree/jetty-9.4.43.v20210629 [23] Source available at https://github.com/facebook/rocksdb/tree/v6.16.4 [24] Source available at https://github.com/cbeust/jcommander/tree/1.78 diff --git a/dependencies.gradle b/dependencies.gradle index 4b6837e41d3..8a2d1708e6d 100644 --- a/dependencies.gradle +++ b/dependencies.gradle @@ -86,7 +86,7 @@ depVersions = [ testcontainers: "1.16.3", vertx: "3.9.8", yahooDatasketches: "0.8.3", - zookeeper: "3.6.2", + zookeeper: "3.8.0" ] depLibs = [ diff --git a/pom.xml b/pom.xml index 7a01a6fff46..511386035d7 100644 --- a/pom.xml +++ b/pom.xml @@ -169,7 +169,7 @@ 1.3.2 1.15.1 3.9.8 - 3.6.2 + 3.8.0 1.1.7 2.1.2 @@ -486,16 +486,8 @@ javacc - org.slf4j - slf4j-log4j12 - - - org.slf4j - slf4j-api - - - log4j - log4j + ch.qos.logback + * io.netty @@ -509,17 +501,13 @@ ${zookeeper.version} test-jar - - org.slf4j - slf4j-log4j12 - org.slf4j slf4j-api - log4j - log4j + ch.qos.logback + * io.netty From dc6869a37a06d744bd333f59597fb9089954a1a5 Mon Sep 17 00:00:00 2001 From: Enrico Olivelli Date: Sun, 27 Mar 2022 12:23:13 +0200 Subject: [PATCH 2/6] fix build --- .../src/main/resources/LICENSE-all.bin.txt | 4 +- .../src/main/resources/LICENSE-bkctl.bin.txt | 4 +- .../src/main/resources/LICENSE-server.bin.txt | 4 +- stream/statelib/pom.xml | 42 ------------------- stream/storage/impl/pom.xml | 42 ------------------- 5 files changed, 6 insertions(+), 90 deletions(-) diff --git a/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt b/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt index 9b7d9c8214c..4102b6a2d67 100644 --- a/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt +++ b/bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt @@ -290,7 +290,7 @@ Apache Software License, Version 2. - lib/org.apache.curator-curator-recipes-5.1.0.jar [34] - lib/org.inferred-freebuilder-2.7.0.jar [35] - lib/com.google.errorprone-error_prone_annotations-2.9.0.jar [36] -- lib/org.apache.yetus-audience-annotations-0.5.0.jar [37] +- lib/org.apache.yetus-audience-annotations-0.12.0.jar [37] - lib/org.jctools-jctools-core-2.1.2.jar [38] - lib/org.apache.httpcomponents-httpclient-4.5.13.jar [39] - lib/org.apache.httpcomponents-httpcore-4.4.13.jar [40] @@ -342,7 +342,7 @@ Apache Software License, Version 2. [34] Source available at https://github.com/apache/curator/releases/tag/apache.curator-5.1.0 [35] Source available at https://github.com/inferred/FreeBuilder/tree/v2.7.0 [36] Source available at https://github.com/google/error-prone/tree/v2.9.0 -[37] Source available at https://github.com/apache/yetus/tree/rel/0.5.0 +[37] Source available at https://github.com/apache/yetus/tree/rel/0.12.0 [38] Source available at https://github.com/JCTools/JCTools/tree/v2.1.2 [39] Source available at https://github.com/apache/httpcomponents-client/tree/rel/v4.4.1 [40] Source available at https://github.com/apache/httpcomponents-core/tree/rel/v4.4.1 diff --git a/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt b/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt index b3cfe2f8db3..67483018798 100644 --- a/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt +++ b/bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt @@ -269,7 +269,7 @@ Apache Software License, Version 2. - lib/org.apache.curator-curator-recipes-5.1.0.jar [33] - lib/org.inferred-freebuilder-2.7.0.jar [34] - lib/com.google.errorprone-error_prone_annotations-2.9.0.jar [35] -- lib/org.apache.yetus-audience-annotations-0.5.0.jar [36] +- lib/org.apache.yetus-audience-annotations-0.12.0.jar [36] - lib/org.jctools-jctools-core-2.1.2.jar [37] - lib/org.apache.httpcomponents-httpclient-4.5.13.jar [38] - lib/org.apache.httpcomponents-httpcore-4.4.13.jar [39] @@ -311,7 +311,7 @@ Apache Software License, Version 2. [33] Source available at https://github.com/apache/curator/tree/apache-curator-5.1.0 [34] Source available at https://github.com/inferred/FreeBuilder/tree/v2.7.0 [35] Source available at https://github.com/google/error-prone/tree/v2.9.0 -[36] Source available at https://github.com/apache/yetus/tree/rel/0.5.0 +[36] Source available at https://github.com/apache/yetus/tree/rel/0.12.0 [37] Source available at https://github.com/JCTools/JCTools/tree/v2.1.2 [38] Source available at https://github.com/apache/httpcomponents-client/tree/rel/v4.4.1 [39] Source available at https://github.com/apache/httpcomponents-core/tree/rel/v4.4.1 diff --git a/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt b/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt index 5e9656af5ed..773ade78ae8 100644 --- a/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt +++ b/bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt @@ -290,7 +290,7 @@ Apache Software License, Version 2. - lib/org.apache.curator-curator-recipes-5.1.0.jar [34] - lib/org.inferred-freebuilder-2.7.0.jar [35] - lib/com.google.errorprone-error_prone_annotations-2.9.0.jar [36] -- lib/org.apache.yetus-audience-annotations-0.5.0.jar [37] +- lib/org.apache.yetus-audience-annotations-0.12.0.jar [37] - lib/org.jctools-jctools-core-2.1.2.jar [38] - lib/org.apache.httpcomponents-httpclient-4.5.13.jar [39] - lib/org.apache.httpcomponents-httpcore-4.4.13.jar [40] @@ -340,7 +340,7 @@ Apache Software License, Version 2. [34] Source available at https://github.com/apache/curator/releases/tag/apache.curator-5.1.0 [35] Source available at https://github.com/inferred/FreeBuilder/tree/v2.7.0 [36] Source available at https://github.com/google/error-prone/tree/v2.9.0 -[37] Source available at https://github.com/apache/yetus/tree/rel/0.5.0 +[37] Source available at https://github.com/apache/yetus/tree/rel/0.12.0 [38] Source available at https://github.com/JCTools/JCTools/tree/v2.1.2 [39] Source available at https://github.com/apache/httpcomponents-client/tree/rel/v4.4.1 [40] Source available at https://github.com/apache/httpcomponents-core/tree/rel/v4.4.1 diff --git a/stream/statelib/pom.xml b/stream/statelib/pom.xml index d2466182dad..eb57a75aa1e 100644 --- a/stream/statelib/pom.xml +++ b/stream/statelib/pom.xml @@ -76,53 +76,11 @@ org.apache.zookeeper zookeeper - ${zookeeper.version} - - - net.java.dev.javacc - javacc - - - org.slf4j - slf4j-log4j12 - - - org.slf4j - slf4j-api - - - log4j - log4j - - - io.netty - * - - org.apache.zookeeper zookeeper - ${zookeeper.version} test-jar - - - org.slf4j - slf4j-log4j12 - - - org.slf4j - slf4j-api - - - log4j - log4j - - - io.netty - * - - diff --git a/stream/storage/impl/pom.xml b/stream/storage/impl/pom.xml index 7b2ff7d5672..58f10990e4c 100644 --- a/stream/storage/impl/pom.xml +++ b/stream/storage/impl/pom.xml @@ -77,53 +77,11 @@ org.apache.zookeeper zookeeper - ${zookeeper.version} - - - net.java.dev.javacc - javacc - - - org.slf4j - slf4j-log4j12 - - - org.slf4j - slf4j-api - - - log4j - log4j - - - io.netty - * - - org.apache.zookeeper zookeeper - ${zookeeper.version} test-jar - - - org.slf4j - slf4j-log4j12 - - - org.slf4j - slf4j-api - - - log4j - log4j - - - io.netty - * - - From 692d27734298105b3ae8ef91c07ae5f5d8a9366d Mon Sep 17 00:00:00 2001 From: Enrico Olivelli Date: Sun, 27 Mar 2022 12:26:21 +0200 Subject: [PATCH 3/6] port gradle changes --- dependencies.gradle | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/dependencies.gradle b/dependencies.gradle index 8a2d1708e6d..d3666041e22 100644 --- a/dependencies.gradle +++ b/dependencies.gradle @@ -29,7 +29,7 @@ depVersions = [ commonsCli: "1.2", commonsCodec: "1.6", commonsCollections4: "4.1", - commonsCompress: "1.21", + commonsCompress: "1.19", commonsConfiguration: "1.10", commonsIO: "2.7", commonsLang2: "2.6", @@ -74,7 +74,7 @@ depVersions = [ prometheus: "0.8.1", protobuf: "3.16.1", reflections: "0.9.11", - rocksDb: "6.29.4.1", + rocksDb: "6.27.3", rxjava: "3.0.1", slf4j: "1.7.32", snakeyaml: "1.30", @@ -86,7 +86,7 @@ depVersions = [ testcontainers: "1.16.3", vertx: "3.9.8", yahooDatasketches: "0.8.3", - zookeeper: "3.8.0" + zookeeper: "3.8.0", ] depLibs = [ @@ -235,9 +235,11 @@ depLibs = [ }, yahooDatasketches: "com.yahoo.datasketches:sketches-core:${depVersions.yahooDatasketches}", zookeeper: dependencies.create("org.apache.zookeeper:zookeeper:${depVersions.zookeeper}") { - exclude group: 'io.netty', module: 'netty-transport-native-epoll' - exclude group: 'log4j', module: 'log4j' - exclude group: 'org.slf4j', module: 'slf4j-log4j12' + exclude group: 'io.netty' + exclude group: 'ch.qos.logback' }, - zookeeperTest: "org.apache.zookeeper:zookeeper:${depVersions.zookeeper}:tests" + zookeeperTest: dependencies.create("org.apache.zookeeper:zookeeper:${depVersions.zookeeper}:tests") { + exclude group: 'io.netty' + exclude group: 'ch.qos.logback' + } ] From 3fa3970d6ca51277c98e9ca41a1fe5eeca50f106 Mon Sep 17 00:00:00 2001 From: Enrico Olivelli Date: Sun, 27 Mar 2022 12:56:20 +0200 Subject: [PATCH 4/6] add OWASP suppressions --- src/owasp-dependency-check-suppressions.xml | 66 ++++++++++++++++++++- 1 file changed, 65 insertions(+), 1 deletion(-) diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml index 3628a297d6d..fa5ae8130e5 100644 --- a/src/owasp-dependency-check-suppressions.xml +++ b/src/owasp-dependency-check-suppressions.xml @@ -108,6 +108,70 @@ ^pkg:maven/org\.arquillian\.cube/arquillian\-cube\-docker@.*$ cpe:/a:redhat:docker - + + + + + e395c1d8a71557b7569cc6a83487b2e30e2e58fe + CVE-2021-28164 + + + + e395c1d8a71557b7569cc6a83487b2e30e2e58fe + CVE-2021-29425 + + + + e395c1d8a71557b7569cc6a83487b2e30e2e58fe + CVE-2021-34429 + + + + 849e8ece2845cb0185d721233906d487a7f1e4cf + CVE-2021-28164 + + + + 849e8ece2845cb0185d721233906d487a7f1e4cf + CVE-2021-29425 + + + + 849e8ece2845cb0185d721233906d487a7f1e4cf + CVE-2021-34429 + + + + 6560f966bcf1aa78d27bcfa75fb6c4463a72c6c5 + CVE-2021-28164 + + + + 6560f966bcf1aa78d27bcfa75fb6c4463a72c6c5 + CVE-2021-29425 + + + + 6560f966bcf1aa78d27bcfa75fb6c4463a72c6c5 + CVE-2021-34429 + From 554bd4e044cad388fa2d114ad7d5d8c41df30ee9 Mon Sep 17 00:00:00 2001 From: Enrico Olivelli Date: Sun, 27 Mar 2022 21:11:07 +0200 Subject: [PATCH 5/6] Add junit-jupiter-api --- bookkeeper-server/pom.xml | 6 ++++++ pom.xml | 9 +++++++++ 2 files changed, 15 insertions(+) diff --git a/bookkeeper-server/pom.xml b/bookkeeper-server/pom.xml index 3fdf47c52c7..bd1ede4d5fc 100644 --- a/bookkeeper-server/pom.xml +++ b/bookkeeper-server/pom.xml @@ -173,6 +173,12 @@ test-jar test + + + org.junit.jupiter + junit-jupiter-api + test + org.xerial.snappy diff --git a/pom.xml b/pom.xml index 511386035d7..4d89e5b16a7 100644 --- a/pom.xml +++ b/pom.xml @@ -145,6 +145,8 @@ 1.14.3 3.2.7 4.12 + + 5.6.2 0.14.2 1.18.20 2.17.1 @@ -516,6 +518,13 @@ + + + org.junit.jupiter + junit-jupiter-api + ${junit5.version} + + org.xerial.snappy From 992b6d819388bb015acfb03035ba81fd5e1ad1bb Mon Sep 17 00:00:00 2001 From: Enrico Olivelli Date: Tue, 29 Mar 2022 15:03:09 +0200 Subject: [PATCH 6/6] Revert gradle change --- dependencies.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dependencies.gradle b/dependencies.gradle index d3666041e22..2592d151420 100644 --- a/dependencies.gradle +++ b/dependencies.gradle @@ -29,7 +29,7 @@ depVersions = [ commonsCli: "1.2", commonsCodec: "1.6", commonsCollections4: "4.1", - commonsCompress: "1.19", + commonsCompress: "1.21", commonsConfiguration: "1.10", commonsIO: "2.7", commonsLang2: "2.6",