Skip to content

Releases: apache/dubbo

dubbo-2.7.13

01 Aug 14:40
9c49efe
Compare
Choose a tag to compare

Features

  • Add the file parameter to MetadataReportBuilder(#8031)
  • Delay export server should print stack trace if there are exception occur. (#8125)
  • Increase the service detection logic on the consumer side of redisRegistry (#7929)
  • support dubbo:annotation element tag in xml when using legacy namespace. (#7995)
  • support disable shutdown hook (#8369)

BugFixs

  • fix instance change event name format problem. (#8346)
  • fix String.format lack of arg which is from BroadcastClusterInvoker link (#8348)
  • disable telnet by default and fix ut, reset resources (#8239)
  • annotation cannt be serializable,so change to String (#7908)
  • Fix the issue that the ReferenceConfigCache#destroy method does not call proxy.$destroy() (#8065)
  • fix multi-registry bug (#8034)
  • [Dubbo-6720] fix bug same interface unexport and export fail. also support hotload service (#6720)
  • Fix urls may be null, and NullPointerException will be thrown in ConfigValidationUtils (#8020) (#8021)
  • Fix duplicated import (#8015)
  • Fix spring spi extension keeps printing warn log during starting. (#6144)
  • Dubbo-8172]Not shuwdown ExecutorService when DefaultFuture. closeChannel() (#8188)

Optimization

  • optimize ShortestResponseLoadBalance active param (#8318)
  • Set specific serializer for native hessian and hessian rpc protocol (#8238)
  • Enhance metadata report config. (#8268)
  • for compatible nacos server lower version, we should check the response from nacos server is null. (#8229)
  • use service name mapping key to avoid logic conflict. (#8184)
  • Tests transaction of callback method #8098 (#8120)
  • improve the code of URLStrParser.java (#8085)
  • remove redundant class: \common\utils\ClassHelper.java (#8084)
  • EventPublishingServiceDiscovery add error log (#8066)
  • add cache for scan result. (#7477) (#8057)
  • Remove needless toString convert (#8092)
  • optimize generic filter (#8067)
  • Ignore invalid MetadataReportConfig (#8068)
  • Optimize StatusTelnetHandler code and extract constants (#8041)
  • Remove redundant code in ServiceConfig#checkAndUpdateSubConfigs method (#8036)
  • Optimize DubboProtocol code and extract constants (#8004)
  • Optimize URL#addParameters method to reuse existing methods (#8005)
  • De-duplicate the filter returned by the getActivateExtension method (#7600)
  • throw exception on path+version not found when decoding request (#8357)

Code Improvement

Thanks for these contribution to improve stability of Apache Dubbo.

#8264, #8258, #8136, #8141, #8114, #8023, #8000, #8001, #8006, #8355

Dependency Upgrades

Upgrading the artifact com.alibaba.spring.spring-context-support: 1.0.11 #8217

dubbo-3.0.1

29 Jun 05:56
Compare
Choose a tag to compare

Optimization

  • Refactor NameMapping to Metadata, Support application field in MigrationRule (#8089)
  • Add cache for scan result. (#8049)
  • Improve config overrides of method and argument (#8054)
  • Support servlet takeover mode (#8123)
  • Add ServiceListener for ServiceConfig (#8134)
  • Improve method callback (#8109)

BugFixs

  • Add force check (#8064)
  • Fix multi-registry will destroy unavailable clusters (#8074)
  • Remove needless toString convert & Enable checking by default (#8073)
  • Ignore invalid MetadataReportConfig (#8069)
  • Fix NPE when consumer start (#8080)
  • Fix some compatiable issues (#8112)
  • Optimize Service related issues (#8122)
  • Opt Migration & Fix reSubscribe for ServiceDiscovery (#8129)
  • Fix NPE in MetadataInfo (#8131)
  • Fix customizer not changed (#8137)

Code Improvement

Thanks for these contribution to improve stability of Apache Dubbo.

#8043, #8044, #8048, #8071, #8119, #8132

dubbo-3.0.0

13 Jun 07:27
Compare
Choose a tag to compare

The core functions of Dubbo 3.0

  • Application-level service discovery mechanism
  • The next generation RPC protocol: Triple
  • Brand new routing rule
  • Remarkable performance improvement
  • Kubernetes Service Integration

Branch difference

Most of the changes until the 03223c7 commit of master branch has been migrated to 3.0.0.

Upgrade compatibility

Compatible with almost all the same behavior as version 2.7.

Extensions

Some extensions of 3rd party SDK will not be provided in Dubbo Core Release, while we will provide dubbo-spi-extensions project to support these less frequently used extensions.

Currently supported extensions:

  • Zookeeper as registry, metadata-report, config-center 
  • Nacos as registry, metadata-report, config-center 
  • Kubernetes as registry 
  • Redis as metadata-report 
  • Apollo as config-center 
  • Hessian2 and jdk is defaultly provided as serializer
  • Protobuf is supported for Triple Protocol

Notice

  • Spring related configuration list below might change, we will provide an upgrade guide in dubbo-website.

  • In the early versions of Dubbo 3, dual-registration and dual-subscribe is defaultly enabled which will provide a high quality of compatibility.

dubbo-2.7.12

08 Jun 04:38
Compare
Choose a tag to compare

Features

  • Injvm protocol support async invoke (#7555)
  • Broadcast mode supports the collection of service response sent by every dubbo provider. (#7645)
  • Add msgpack serialization support (#7697)
  • Add configurable file parameter to MetadataReportConfig (#7747)
  • The instance generated by DubboReference supports AOP (#7644)
  • Support sending generic requests in JSON format (#7637)
  • Add a new Router class for making requests targeted at specified ip and port (#7756)
  • Support timeout intercept on provider side (#7851)
  • Support ignored Network Interfaces (#7884)
  • Support url merge processor extension (#7860)
  • SSL support ciphers&protocols (#7740) (#7998)

BugFixs

  • Fix ZookeeperServiceDiscovery#getInstances not deal with healthyOnly (#7692)
  • Fix Using Gson serialization can cause Exception messages to be lost (#7680)
  • Fix url was truncated expectedly (#7716)
  • When using multiple protocols and having port specified, service can not be started. (#7656)
  • Fix method annotation callback do not work problem (#7754)
  • Process TypeDefinition#properties when it is not a primitive type object (#7579)
  • Fix: Support Lazy annotation (#7981)

Code Improvement

Thanks for these contribution to improve stability of Apache Dubbo.

#7683, #7684, #7632, #7689, #7675, #7698, #7701, #7681, #7711, #7688, #7717, #7721, #7727, #7723, #7704, #7725, #7712, #7734, #7738, #7742, #7746, #7748, #7751, #7762, #7317, #7618, #7591, #7753, #7778, #7802, #7737, #7774, #7790, #7793, #7795, #7798, #7799, #7788, #7787, #7801, #7804, #7777, #7806, #7814, #7812, #7816, #7820, #7821, #7461, #6838, #7819, #3855, #7840, #7844, #7867, #7835, #7602, #7858, #7863, #7869, #7870, #7871, #7894, #7885, #7875, #7880, #7887, #7901, #7903, #7902, #7910, #7911, #7915, #7918, #7270, #7369, #7440, #7468, #7940, #7919, #7926, #7951, #7946, #7962, #7462, #7956, #7958, #7965, #7964, #7972, #7974, #7970, #7967, #7994

Dependency Upgrades

  • Upgrading the artifact redis.clients.jedis:3.6.0 #7791
  • Upgrading the artifact com.alibaba.nacos.nacos-client:1.4.2 #7996

dubbo-2.6.10.1

29 May 17:15
Compare
Choose a tag to compare

Notice

1. ScriptRouter

ScriptRouter will not be activated defaultly. If user still wants use it, please add scriptRouterFactory in selfs spi file.
See dubbo-cluster/src/test/resources/META-INF/dubbo/internal/org.apache.dubbo.rpc.cluster.RouterFactory

2. Gerenic Invoke

Native Java deserialization will not be activated defaultly. If user still wants use it, please set dubbo.security.serialize.generic.native-java-enable as true in environment.

3. Serialization Block List

An embedded serialization block list is introduced in dubbo-common/src/main/resources/security/serialize.blockedlist.
If user wants to add allow list, please refer dubbo.security.serialize.allowedClassList.

4. Serialization ID Check

An optional checker can be enabled to check if consumer has sent the permitted serialiaztion id and consumer has received the same serialization id like it sent to provider. You can set serialization.security.check as true to enable this feature.

Change Lists

  • Evacuation unnecessary example Initialization, creation Resource cost
  • Fix TPS Limiter not work under Dynamic Configuration
  • Solve the problem of not sharing the shared connection under lazy mode
  • Fix methodName and retries in FailoverClusterInvoker
  • Fix Dubbo qos command not work to offline provider
  • Add socks5 proxy support to netty4 client
  • Support high version Nacos
  • Add some serialize check
  • Fix MonitorService missing side=consumer paramter issue
  • Fix netty3 backlog
  • Fix Deserialization vulnerability

dubbo-2.7.11

06 May 16:39
Compare
Choose a tag to compare

Optimization

  • Use nodeCache to take place of treeCache. (#7466)
  • When first getServiceAppMapping, reduce one time network transport. (#7298)
  • Optimize code for loop condition (#7480)
  • Compatible Switch to interface level service discovery when the registry does not support service introspection architecture (#7506)
  • Optimization generic releaize and generalize (#7520)
  • Use @SPI's wrapper method to report a null pointer exception bug (#7326)
  • Throw exception when data bind from properties file encounter error (#4757)
  • Simplify OptionUtil#prefixEndOf (#5833)
  • Fix password be print in plain text (#6931)
  • Optimize some code related to consul (#7523)
  • Move ContextFilter to lowest order (#7533)
  • When getRegistry error, log error. (#7545)
  • Add ClusterRules LoadbalanceRules to dubbo common (#7534)
  • Use CollectionUtils methods to perform Collection null validation (#7559)
  • SPI default name adjustment (#7557)
  • Merge exceptions, remove redundant interface implementations (#4730)
  • Optimize code to remove useless objects (#7582)
  • Use double-check to get elements from the cache (#7583)
  • Remove redundant references (#7604)
  • Fix default config is invalid (#7607)
  • Optimize the creation of executor for ThreadPoolExecutor in ZookeeperDynamicConfiguration (#7617)
  • When making a generic dubbo service request, setting check to true could cause memory leaks (#7599)
  • Remove duplicate calling metadataInfo#calAndGetRevision methods (#7630)
  • Remove EventListener usage in DubboBootstrap (#7638)
  • Convert the IllegalArgumentException generated by PojoUtils.realize in GenericFilter to RpcException (#7643)
  • Fix the problem of ProtocolConfig requiring a name parameter in new versions of Dubbo (#7624)
  • Make Dubbo2.7.x not register serviceNameMapping information with the registry by default. (#7672)

Features

  • Add options configuration mechanism for JdkCompiler. (#7232)
  • Add arguments router to ConditionRouter (#7378)
  • Solve the problem of repeatedly registering the BeanDefinition of the provider (#7494)
  • Add annotations field to matedata definition (#7660)

Bugfixs

  • Fix incorrect handling of the URLBuilder caused the wrong URL to be generated (#7501)
  • Fix bug for export async ignore exception (#7507)
  • Fix the DubboReference * version is invalid issue (#7489)
  • Fix the StatItem.isAllowable() always lets 1 more request pass (#4141)
  • Clear destroyed invokers in AbstractProxyProtocol (#4738)
  • Set default needReconnect true when channel is not connected (#6873)
  • Fix registry of etcd set 'group' cannot isolate (#4825)
  • Fix lock in DubboProtocol#getSharedClient (#6018)
  • Fix code type in ExceptionFilter (#6932)
  • Make generic param as group,version handled in org.apache.dubbo.rpc.cluster.support.ClusterUtils (#6900)
  • Solve Broadcast cluster means that multiple machines will be called,which is not converted to injvm protocol at this time. (#7365)
  • Fix repeat adding parameters to the URL (#7498)
  • Fix incorrect definition of instance variable name (#7547)
  • Fix the build on Linux ARM64 CPU architecture (#7408)
  • Consumer config tag override privode tag config (#5975)
  • Fix RegistryProtocol Logger (#7546)
  • Fix unlisten mismatch key problem. (#7465)
  • Fix issue that could lead to multiple init in MetadataReportInstance#init (#7586)
  • Fix field may be null, avoid throwing NullPointerException (#7620)
  • Fix method may be null in RpcUtils,avoid throwing NullPointerException (#7627)
  • Fix localAddress may be null,avoid throwing NullPointerException (#7622)
  • Fix method may be null, and NullPointerException will be thrown in MethodUtils (#7606)
  • Fix RegistryProtocol registerStatedUrl NPE. (#7610)
  • Fix setSkyWalkingDynamicField(java.lang.Object) not found (#7517)
  • Fix delete last config not take effect (#6964)
  • Fix remoteMap may be null to avoid NullPointerException being thrown (#7654)
  • Fix EtcdServiceDiscovery not overriding the getUrl method, causing subscribe to throw an exception (#7659)
  • Fix Dubbo zookeeper registry failed to re-subscribe (#7669)
  • ZookeeperServiceDiscovery curator client support multi address. (#7285)

Dependency Upgrades

  • Upgrading the artifact org.javassist.javassist:3.23.1-GA #7516
  • Upgrading the artifact com.alibaba.nacos.nacos-client:1.4.1 #7676

Contributors

Thanks for the following contributors for this release:

dubbo-2.7.10

02 Apr 13:12
Compare
Choose a tag to compare

Notice

1. ScriptRouter

ScriptRouter will not be activated defaultly. If user still wants use it, please add scriptRouterFactory in selfs spi file.
See dubbo-cluster/src/test/resources/META-INF/dubbo/internal/org.apache.dubbo.rpc.cluster.RouterFactory

2. Gerenic Invoke

Native Java deserialization will not be activated defaultly. If user still wants use it, please set dubbo.security.serialize.generic.native-java-enable as true in environment.

3. Serialization Block List

An embedded serialization block list is introduced in dubbo-common/src/main/resources/security/serialize.blockedlist.
If user wants to add allow list, please refer dubbo.security.serialize.allowedClassList.

Optimization

  • Heartbeat skip serialize and deserialize (#7077 , #7168)
  • Simplity some code (#7179)
  • Move the check of timeToLiveMillis out of the loop (#7171)
  • Improve error message of create extension failure (#7131)
  • Refactor ProtocolFilterWrapper$1 to FilterNode (#6962)
  • Consumer-side Executor is changed to global sharing, no longer sharing by provider Port (#7109)
  • Fix ReflectUtils not support generic call with Future (#7041)
  • Add the end of line character make dubbo-qos easier to view. (#6033)
  • Group variables into a common class (#6179)
  • Refactoring (move method) to AccessLogData class (#6151)
  • Fix genericservice compatible problem. (#6124)
  • Separate metadataReport cache file base by application dimension. (#7260)
  • Redundant box for boolean and refactor method filterInvoker (#7316)
  • Extract AccessibleObject.setAccessible(boolean) to ReflectUtils (#6909)
  • Reduce unnecessary hashmap operation in CuratorConnectionStateListener (#6783)
  • Optimize code in dubbo-common (#5597)
  • Polish DubboBootstrap (#5996)
  • Polish LFUCache (#5994)
  • Remove unnecessary logger which is defined at subclass. (#7262)
  • Cache Class avoid PermGen space OOM (#7374)
  • If the channel has been closed, return directly. (#7410)
  • Use java box to prevent malicious code. (#7428)
  • Add serialize class checker (#7436)
  • Add empty constructor for DubboLifecycleComponentApplicationListener (#7357)
  • Optimize the selection of invokers in the multi-registry scenario (#7446)

Features

  • BroadcastClusterInvoker doInvoker can return early when an exception occurs in execution (#7174)
  • A new class (InternalRunnable) is added to wrap the ordinary Runnable, which implements automatic cleaning of InternalThreadLocal (#6141)
  • NacosRegistry register instance support PreservedMetadataKeys (#7090)
  • Solve local exposure, the server opens the token, and the client call fails (#7334)
  • SSL support load from classpath (#6756)
  • Make keepalive parameters configurable on server (#6500)
  • Check service is start success in dubbo-qos (#7370)
  • Support a way to ignore check some key in parameters. (#7371)

Bugfixs

  • Config with registries and registryIds, protocols and protocolIds is chaotic (#6968)
  • Fix 'java.io.FileNotFoundException' when 'dump.directory' not exists (#7178)
  • Fix Extended LoadBalance ran 2 times during service call (#7192)
  • Remove parameters from registryUrl to prevent config pollution (#7189)
  • Fix the problem that LocalDate type is forced to be converted to LocalDateTime error (#7028)
  • Fix LFU policy configuration not work (#7083)
  • Remove repeat action of register DubboBootStrapApplicationListener in ServiceClassPostProcessor, it already register in DubboApplicationListenerRegistrar (#7000)
  • Interoperability with 2.6.x provider urls having "default.xxx" keys (#7239)
  • Fix MonitorFilter, provider remote_host wrong problem. (#7008)
  • Ignore '#' when parsing url (#7114)
  • Fix Exception stack information acquisition optimization (#6985)
  • PojoUtils realize not current for Multidimensional primitive array (#6178)
  • Avoid npe when encode request (#6961)
  • @wrapper without annotations @retention cause extension set matches and mismatches invalid (#6947)
  • Fix ConfigCenter namespace read bug in apollo, etcd and so on. (#6717)
  • start.sh can't work when dubbo.properties contain commented dubbo.protocol.port property (#6508)
  • The channel will not closed in time when timeout by using telnet in QOS (#7282)
  • DubboHandlerRegistry#removeService NPE issue. (#7286)
  • DubboBootstrap.destroy calls DubboShutdownHook.destroyProtocols repeatedly (#7303)
  • Fix zk service discovery, create parent node if absent (#7304)
  • Fix filter chain order (#7305)
  • AbstractRegistryFactory#getRegistry and destroyAll methods compete for locks in multiple threads (#7273)
  • Fix generic interface metadata publish log error (#6746)
  • Fix reflect invoke error in org.apache.dubbo.common.utils.PojoUtils#generalize (#6905)
  • Fix org.apache.dubbo.common.URL#equals. After comparing the parameters, the method will skip the following branches (#7335)
  • Solve use api, application-level service discovery model startup error (#7352)
  • Didn't judge check in serviceDiscoveryRegistry (#7340)
  • Fix QOS Ready command return OK when DubboBootstrap is not ready (#7333)
  • Multicast use valid network interface (#6734)
  • Fix DecodeableRpcResult override attachments (#6590)
  • Fix OOM issue for Hessian2ObjectInput and Hessian2ObjectOutput (#6848)
  • Fix url add repeatedly (#7376)
  • Fix codec2 SPI not work (#7400)
  • NacosRegistry,NacosMetadataReport,NacosDynamicConfiguration compatible with innerclass symbol  '$' (#7346)
  • Fix expire cache time (#6480)
  • Add provided-by paramater for DubboReference (#7451)
  • Fix NullPointException in DynamicDirectory (#7439)
  • Promise doSubscribe notify and childListen notify synchronize. (#7126)
  • Use safeConstructor instead of constructor when parsing yaml (#7437)
  • Fix passing wrong parameter when calling MigrationInvoker.compareAddresses() (#7460)
  • Fix RedisMetadataReport cluster password is null (#7474)
  • Unregister onconnect and ondisconnect information (#7482)
  • Fix client-side and server-side payload parameters are inconsistent, and the server-side response data packet length exceeds the client-side payload. (#7287)
  • Fix too many instance bean created (#7438)

Dependency Upgrades

  • Upgrading the artifact org.hamcrest.hamcrest:2.2 #7330

Contributors

Thanks for the following contributors for this release:

3.0.0.preview

19 Mar 12:55
Compare
Choose a tag to compare
3.0.0.preview Pre-release
Pre-release

This is the first preview version of 3.0. we defined 3.0.0.preview as an unstable version in a very early test state to help users and developers quickly understand and experience 3.0 core features. We will continue to work seamlessly with the community to release a more stable version in the future. Please pay attention to our roadmap for the specific time plan.

Check this article for the design of 3.0: https://mp.weixin.qq.com/s/UMhVRA9nje4oEa44U5ibAg
Check here for samples demonstrating the usage of some core features: https://github.com/apache/dubbo-samples

More docs will be ready and published on website

The core functions of the current preview release:

  • Application-level service discovery mechanism
  • The next generation RPC protocol: Triple
  • Brand new routing rule
  • Remarkable performance improvement

Upcoming features:

  • Kubernetes Service Integration

Functions that are still in early development or design status:

  • Proxyless Mesh (xDS)
  • Observability
  • Back-pressure based dynamic traffic routing

dubbo-2.7.9

07 Feb 17:03
Compare
Choose a tag to compare

Bugfixes

  • fix host parse issue with ipv6 format #6836
  • fix Pojoutils.java#getDefaultValue to support boolean, short and byte
  • prevent RpcStatus#begincount int overflow in extreme cases #6801
  • remove notified item when unsubscribe #6790
  • fix potential NPE in generic filter #6785
  • set registry zone does not work properly #6667
  • set config center group when registry group is not null #6532
  • Remove registry notification retry task #6401
  • Webservices, #6495 #6478
  • Introduce DubboBootstrap start/stop listener #7159

dubbo-2.7.8

28 Jul 02:18
0be2a1b
Compare
Choose a tag to compare

Features

  • Upgrading the Nacos Registry to support the dynamic properties #6417
  • REST Protocol Enhancement to support Tomcat 9.x #6402 #6418
  • Hessian2 supports Whitelist #6378 #6415
  • Save memory usage in TagRouter #6083 #6082
  • Deleting useless logic from Configurator #6395
  • Adding the validating for the RPC invocation method parameters #6374
  • Registering the common beans for Spring XML meta-configuration #6175 #6288
  • Supporting TypeBuilder sorting #6365 #6307 #6306
  • Service Introspection Enhancement #6366
    • Refatoring MetadataServiceExporter #6356
    • Introducing the composite implementation of MetadataService #6171
    • Merging all subscribied URLs from the multiple services #6346
    • Introducing the method of supporting the config-center for the Registry interface #6319
    • Refactoring MetadataReport's methods #6310
    • Adding the "services" attribute into <dubbo:reference> element #6173
    • Adding the "services" attribute methods into @DubboReference #6172
    • Introducing the composite ServiceNameMapping #6342
    • Introducing the externalized configuration for ServiceNameMapping #6170
    • org.apache.dubbo.metadata.ServiceNameMapping #6336
    • Using mandatory implementation of Service Instance registration instead of the event #6333
    • Refactoring the implememtation of MetadataReport based on The Config-Center infrastructure #6315
    • Adding the implementation of MetadataReport's new methods for Nacos #6309
    • ServiceConfig and ReferenceConfig publish the ServiceDefinition based on the Dubbo Event #6305
    • Adding the new methods into MetadataReport to manipulate the exported URLs for service introspection #6296
    • Changing the behavior of RegistryConfig#getUseAsConfigCenter to be optional #6247
  • Adding visual-studio-code ignore #6221 #6287
  • Put default version&group from provider and consumer into service metadata #6111
  • Reduce memory allocation during address change notification #5613
  • check invoker available status after proxy created. #6435
  • Introducing default behavior of the properties "useAsConfigCenter" and "useAsMetadataCenter" in RegistryConfig #6459

Bugfixes

  • Resolving the issue about Spring Beans Initializing eagerly #6419
  • Fix callback throw "Not found exported service" when serviceUrl has bind.port paramater. #6223
  • Resolving the issue on ConsulServiceDiscovery#getServices() returning null #6389
  • Fix ClassCastException in PojoUtils #6106
  • Fix NPE when check=false is set and provider is empty #6376
  • Fix the priority of ListenableRouter were not effective #4822 #6148
  • Changing the log level to be info when the url is generic #6241#6363
  • Resolving the issue about @DubboReference‘s Filter Chain not working on Spring local beans #6224
  • Fixing NacosDynamicConfiguration#publishConfig bug #6198
  • dubbo-compatible @SPI interface compatible not work #6428
  • The duplicated path in Tree-Path config-center #6442
  • The missing protocol of MetadataReportConfig when the proeprty "useAsMetadataCenter" of RegistryConfig is enabled #6476
  • Resolving the issue of duplicated registration for DubboBootstrapApplicationListener #6231#6253

Dependency Upgrades

  • Upgrading the artifact com.alibaba.spring:spring-context-support:1.0.7 #6425
  • Upgrading the artifact com.alibaba.spring:spring-context-support:1.0.8 #6457
  • Upgrading the artifact com.alibaba:dubbo-hessian-lite:3.2.8 #6262
  • Upgrading the artifact com.alibaba:fastjson:1.2.70 #6254
  • Upgrading the artfcat com.alibaba.nacos:nacos-client:1.3.1 #6465

Vulnerability

https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E

This vulnerability can affect all Dubbo users using 2.5.x, 2.6.x and 2.7.x, please upgrade to 2.6.9 or 2.7.8 to solve this issue. Check here for how to enable Hessian2 whitelist/blacklist: #6378

Contributors

Thanks for the following contributors for this release: