Skip to content

security: upgrade kafka-clients to 3.6.1 - #6147

Merged
funky-eyes merged 4 commits into
apache:2.xfrom
slievrly:2.x_23_12_13_03
Dec 20, 2023
Merged

security: upgrade kafka-clients to 3.6.1#6147
funky-eyes merged 4 commits into
apache:2.xfrom
slievrly:2.x_23_12_13_03

Conversation

@slievrly

Copy link
Copy Markdown
Member
  • I have registered the PR changes.

Ⅰ. Describe what this PR did

upgrade kafka-clients to 3.5.2

Ⅱ. Does this pull request fix one issue?

fixes #6092

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

Comment thread dependencies/pom.xml Outdated
<logback.version>1.2.9</logback.version>
<logstash-logback-encoder.version>6.5</logstash-logback-encoder.version>
<kafka-appender.version>0.2.0-RC2</kafka-appender.version>
<kafka-clients.version>3.5.2</kafka-clients.version>

@funky-eyes funky-eyes Dec 13, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use 3.6.1?

Suggested change
<kafka-clients.version>3.5.2</kafka-clients.version>
<kafka-clients.version>3.6.1</kafka-clients.version>

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all resolved.

@codecov

codecov Bot commented Dec 13, 2023

Copy link
Copy Markdown

Codecov Report

Merging #6147 (188f629) into 2.x (501d431) will increase coverage by 0.01%.
Report is 1 commits behind head on 2.x.
The diff coverage is 0.00%.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff              @@
##                2.x    #6147      +/-   ##
============================================
+ Coverage     48.98%   49.00%   +0.01%     
+ Complexity     4782     4781       -1     
============================================
  Files           913      913              
  Lines         31697    31697              
  Branches       3823     3823              
============================================
+ Hits          15528    15532       +4     
+ Misses        14632    14628       -4     
  Partials       1537     1537              
Files Coverage Δ
...n/java/io/seata/core/rpc/netty/ChannelManager.java 0.00% <ø> (ø)
...va/io/seata/integration/tx/api/util/DubboUtil.java 0.00% <0.00%> (ø)

... and 4 files with indirect coverage changes

Comment thread changes/zh-cn/2.x.md Outdated

### security:
- [[#6069](https://github.com/seata/seata/pull/6069)] 升级Guava依赖版本,修复安全漏洞
- [[#6147](https://github.com/seata/seata/pull/6147)] 升级 kafka-clients依赖至3.5.2

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- [[#6147](https://github.com/seata/seata/pull/6147)] 升级 kafka-clients依赖至3.5.2
- [[#6147](https://github.com/seata/seata/pull/6147)] 升级 kafka-clients依赖至3.6.1

Comment thread changes/en-us/2.x.md Outdated

### security:
- [[#6069](https://github.com/seata/seata/pull/6069)] Upgrade Guava dependencies to fix security vulnerabilities
- [[#6147](https://github.com/seata/seata/pull/6147)] upgrade kafka-clients to 3.5.2

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- [[#6147](https://github.com/seata/seata/pull/6147)] upgrade kafka-clients to 3.5.2
- [[#6147](https://github.com/seata/seata/pull/6147)] upgrade kafka-clients to 3.6.1

@funky-eyes funky-eyes added this to the 2.1.0 milestone Dec 15, 2023
@slievrly slievrly changed the title security: upgrade kafka-clients to 3.5.2 security: upgrade kafka-clients to 3.6.1 Dec 19, 2023

@funky-eyes funky-eyes left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@funky-eyes
funky-eyes merged commit 3df1704 into apache:2.x Dec 20, 2023
YvCeung pushed a commit to YvCeung/incubator-seata that referenced this pull request Dec 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2.0.0 版本引用kafka存在Apache Kafka Clients JNDI注入漏洞 (CVE-2023-25194),望修复

2 participants