Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Jetty Upgrade: 12.x.x or latest #22939

Open
2 tasks done
devendrasr opened this issue Jun 19, 2024 · 6 comments
Open
2 tasks done

Jetty Upgrade: 12.x.x or latest #22939

devendrasr opened this issue Jun 19, 2024 · 6 comments
Labels
type/enhancement The enhancements for the existing features or docs. e.g. reduce memory usage of the delayed messages

Comments

@devendrasr
Copy link

devendrasr commented Jun 19, 2024 •
edited
Loading

Search before asking

  • I searched in the issues and found nothing similar.

Motivation

Team,

The version of jetty being used is somewhere around 9.x.x. This one is vulnerable and getting outdated. We need to migrate closer to 12.x.x. Any plans or approach would be highly appreciated.

Solution

No response

Alternatives

No response

Anything else?

No response

Are you willing to submit a PR?

  • I'm willing to submit a PR!
@devendrasr devendrasr added the type/enhancement The enhancements for the existing features or docs. e.g. reduce memory usage of the delayed messages label Jun 19, 2024
@lhotari
Copy link
Member

lhotari commented Jun 19, 2024

I agree that we need to migrate to Jetty 12. There's a dev mailing list thread about this, https://lists.apache.org/thread/d7dqy4w9x1dyrcdrymoypv3v3p7bncxx .

I have already put a lot of time in this, but it's a lot of work to complete the migration. I have everything compiling, but there are some test failures. The WIP branch is here: https://github.com/lhotari/pulsar/pull/190/files .

The version of jetty being used is somewhere around 9.x.x. This one is vulnerable and getting outdated.

We use 9.4.54.v20240208 in Pulsar. I'm not aware of medium or high severity vulnerabilities in this version. The main issue is that it isn't maintained, that's explained in the email thread, https://lists.apache.org/thread/d7dqy4w9x1dyrcdrymoypv3v3p7bncxx.

@devendrasr
Copy link
Author

Thanks for all the context. Let me go through provided information.

@devendrasr
Copy link
Author

Looks like a lot of work has already been accomplished. I will be waiting for the pull request to be merged - lhotari#190

@lhotari
Copy link
Member

lhotari commented Jun 20, 2024 •
edited
Loading

Looks like a lot of work has already been accomplished. I will be waiting for the pull request to be merged - lhotari#190

It's going to take some time since there are blockers. One of them is with Bookkeeper. We will need to upgrade Jetty in Bookkeeper before Pulsar since Pulsar puts all libraries in the same classpath. Pulsar's distribution also includes Bookkeeper.

Hopefully we could accomplish this before Pulsar 4.0 in October.

@lhotari
Copy link
Member

lhotari commented Jun 24, 2024

Bookkeeper mailing list discussion: https://lists.apache.org/thread/jkgnr9tt947fzshpoojn0r8n2pnr0h3f

@lhotari
Copy link
Member

lhotari commented Jun 24, 2024

PR to upgrade Jetty 12 in Bookkeeper: apache/bookkeeper#4447

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type/enhancement The enhancements for the existing features or docs. e.g. reduce memory usage of the delayed messages
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lhotari @devendrasr