apache / apache/rocketmq-clients
[Enhancement] Netty Version Upgrade
- Dominant language
- Java
- Stars
- 505
- Forks
- 313
- Avg merge
- 11h 28m
- Merged PRs (30d)
- 6
Description
### Before Creating the Enhancement Request
- [x] I have confirmed that this should be classified as an enhancement rather than a bug/feature.
### Programming Language of the Client
Java
### Summary
The latest verion of rocketmq-client-java 5.2.1 is currently using a older version of netty jar < 4.1.100.Final There are quiet a lot of vulnerabilities in each of the older version of netty jars.
Is it possible in the next release of rocketmq-client-java that there will be a latest version of netty jar like 4.1.136.Final
### Motivation
To have components updated with latest version, so vulnerabilities are reduced
### Describe the Solution You'd Like
Upgrade of Netty jar and its related components
### Describe Alternatives You've Considered
rocketmq-client-java-noshade was also considered. But the vulnerability is now seen in io.grpc:grpc-netty-shaded which is also using older version of netty jars
### Additional Context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the dependency declarations for rocketmq-client-java 5.2.1 and grpc-netty-shaded, then inspect the resolved Netty versions and related components. Done means the supported release uses an updated Netty version such as 4.1.136.Final, vulnerabilities are reduced, and the existing client tests still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100