apache / apache/rocketmq-clients

[Enhancement] Netty Version Upgrade

Open
#1,313 6 comments 0 reactions 0 assignees View on GitHub
type/enhancement
Dominant language
Java
Stars
505
Forks
313
Avg merge
11h 28m
Merged PRs (30d)
6

Description

### Before Creating the Enhancement Request

- [x] I have confirmed that this should be classified as an enhancement rather than a bug/feature.

### Programming Language of the Client

Java

### Summary

The latest verion of rocketmq-client-java 5.2.1 is currently using a older version of netty jar < 4.1.100.Final There are quiet a lot of vulnerabilities in each of the older version of netty jars.

Is it possible in the next release of rocketmq-client-java that there will be a latest version of netty jar like 4.1.136.Final

### Motivation

To have components updated with latest version, so vulnerabilities are reduced

### Describe the Solution You'd Like

Upgrade of Netty jar and its related components

### Describe Alternatives You've Considered

rocketmq-client-java-noshade was also considered. But the vulnerability is now seen in io.grpc:grpc-netty-shaded which is also using older version of netty jars

### Additional Context

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the dependency declarations for rocketmq-client-java 5.2.1 and grpc-netty-shaded, then inspect the resolved Netty versions and related components. Done means the supported release uses an updated Netty version such as 4.1.136.Final, vulnerabilities are reduced, and the existing client tests still pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java
Domain
build-system, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.