Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump versions of reactor-core and reactor-netty #11500

Merged
merged 5 commits into from
Dec 7, 2023
Merged

Conversation

mch2
Copy link
Member

@mch2 mch2 commented Dec 6, 2023

Description

Bump versions of reactor-core and reactor-netty on 1.x line.

Related Issues

Resolves CVE-2023-34062 and CVE-2023-34054

Check List

  • New functionality includes testing.
    • All tests pass
  • New functionality has been documented.
    • New functionality has javadoc added
  • Failing checks are inspected and point to the corresponding known issue(s) (See: Troubleshooting Failing Builds)
  • Commits are signed per the DCO using --signoff
  • Commit changes are listed out in CHANGELOG.md file (See: Changelog)
  • Public documentation issue/PR created

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
Copy link
Contributor

github-actions bot commented Dec 6, 2023

Gradle Check (Jenkins) Run Completed with:

Copy link
Contributor

github-actions bot commented Dec 6, 2023

Gradle Check (Jenkins) Run Completed with:

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
@mch2
Copy link
Member Author

mch2 commented Dec 7, 2023

@reta @kotwanikunal Made changes here after approvals - the versions I bumped to required a bump in jackson-databind that is not compatible with our gradle version on 1.x. Instead moved these to the latest patch versions within the same minor that also resolve this CVE.

@kotwanikunal
Copy link
Member

You also need to rebase for the changelog :)

Copy link
Contributor

github-actions bot commented Dec 7, 2023

Gradle Check (Jenkins) Run Completed with:

Signed-off-by: Marc Handalian <handalm@amazon.com>

This comment was marked as outdated.

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
Copy link
Contributor

github-actions bot commented Dec 7, 2023

Gradle Check (Jenkins) Run Completed with:

Copy link
Contributor

github-actions bot commented Dec 7, 2023

Gradle Check (Jenkins) Run Completed with:

Copy link

codecov bot commented Dec 7, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (15182ca) 77.60% compared to head (531a094) 77.64%.

Additional details and impacted files
@@             Coverage Diff              @@
##                1.x   #11500      +/-   ##
============================================
+ Coverage     77.60%   77.64%   +0.03%     
- Complexity    58777    58837      +60     
============================================
  Files          4223     4223              
  Lines        253559   253559              
  Branches      38701    38701              
============================================
+ Hits         196768   196865      +97     
+ Misses        40753    40735      -18     
+ Partials      16038    15959      -79     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@mch2 mch2 merged commit 2059d94 into opensearch-project:1.x Dec 7, 2023
10 checks passed
mch2 added a commit to mch2/OpenSearch that referenced this pull request Dec 7, 2023
…1500)

* Bump versions of reactor-core and reactor-netty

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

* Change to 3.4 line of reactore-core and 1.0 line of reactor-netty.

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

* update SHAs

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

* fix thirdPartyAudit

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

---------

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
Signed-off-by: Marc Handalian <handalm@amazon.com>
mch2 added a commit to mch2/OpenSearch that referenced this pull request Dec 7, 2023
…1500)

* Bump versions of reactor-core and reactor-netty

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

* Change to 3.4 line of reactore-core and 1.0 line of reactor-netty.

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

* update SHAs

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

* fix thirdPartyAudit

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>

---------

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
Signed-off-by: Marc Handalian <handalm@amazon.com>
Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
mch2 added a commit that referenced this pull request Dec 7, 2023
* Bump versions of reactor-core and reactor-netty



* Change to 3.4 line of reactore-core and 1.0 line of reactor-netty.



* update SHAs



* fix thirdPartyAudit



---------

Signed-off-by: Marc Handalian <marc.handalian@gmail.com>
Signed-off-by: Marc Handalian <handalm@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 1.3 Backport to 1.3 branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants