Skip to content

Conversation

@merlimat
Copy link
Contributor

@merlimat merlimat commented Oct 2, 2025

Motivation

├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ io.grpc:grpc-netty-shaded                                    │ CVE-2025-55163 │ HIGH     │ fixed    │ 1.72.0            │ 1.75.0        │ netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS     │
│ (io.grpc-grpc-netty-shaded-1.72.0.jar)                       │                │          │          │                   │               │ Vulnerability                                                │
│                                                              │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2025-55163                   │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤          ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤

Modifications

Verifying this change

  • Make sure that the change passes the CI checks.

(Please pick either of the following options)

This change is a trivial rework / code cleanup without any test coverage.

(or)

This change is already covered by existing tests, such as (please describe tests).

(or)

This change added tests and can be verified as follows:

(example:)

  • Added integration tests for end-to-end deployment with large payloads (10MB)
  • Extended integration test for recovery after broker failure

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

  • Dependencies (add or upgrade a dependency)
  • The public API
  • The schema
  • The default values of configurations
  • The threading model
  • The binary protocol
  • The REST endpoints
  • The admin CLI options
  • The metrics
  • Anything that affects deployment

Documentation

  • doc
  • doc-required
  • doc-not-needed
  • doc-complete

Matching PR in forked repository

PR in forked repository:

@github-actions github-actions bot added the doc-not-needed Your PR changes do not impact docs label Oct 2, 2025
@merlimat merlimat added release/4.1.2 release/4.0.8 release/3.0.15 and removed doc-not-needed Your PR changes do not impact docs labels Oct 2, 2025
@merlimat merlimat changed the title Update gRPC to 1.75.0 [fix] Update gRPC to 1.75.0 Oct 2, 2025
@github-actions github-actions bot added the doc-not-needed Your PR changes do not impact docs label Oct 2, 2025
@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.24%. Comparing base (771ce41) to head (1f9ff23).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff              @@
##             master   #24813      +/-   ##
============================================
- Coverage     74.50%   74.24%   -0.27%     
+ Complexity    33895    33392     -503     
============================================
  Files          1912     1912              
  Lines        149072   149072              
  Branches      17299    17299              
============================================
- Hits         111071   110674     -397     
- Misses        29218    29553     +335     
- Partials       8783     8845      +62     
Flag Coverage Δ
inttests 26.33% <ø> (-0.41%) ⬇️
systests 22.75% <ø> (-0.16%) ⬇️
unittests 73.76% <ø> (-0.28%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 106 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@merlimat merlimat merged commit cc0eef9 into apache:master Oct 3, 2025
93 of 97 checks passed
merlimat added a commit that referenced this pull request Oct 3, 2025
merlimat added a commit that referenced this pull request Oct 3, 2025
@merlimat merlimat deleted the upgrade-grpc branch October 3, 2025 00:56
LucasEby pushed a commit to LucasEby/pulsar that referenced this pull request Oct 3, 2025
walkinggo pushed a commit to walkinggo/pulsar that referenced this pull request Oct 8, 2025
manas-ctds pushed a commit to datastax/pulsar that referenced this pull request Oct 15, 2025
@lhotari
Copy link
Member

lhotari commented Oct 28, 2025

I removed the label for 3.0.x since upgrading gRPC for 3.0.x is most likely not compatible with BookKeeper's generated stubs for stream storage in BookKeeper 4.16.x branch. In BookKeeper 4.17.x branch, gRPC 1.72.0 is used and 4.17.2 was released with gRPC 1.72.0 which is most likely compatible with gRPC 1.75.0.

srinath-ctds pushed a commit to datastax/pulsar that referenced this pull request Nov 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants