-
Notifications
You must be signed in to change notification settings - Fork 3.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chores(deps): Bump armeria.version from 1.17.2 to 1.24.3 #3557
Conversation
Resolves CVE-2023-38493 (Issue openzipkin#3556) Bump netty.version to align to latest Bump jackson.versio to align to latest Bump micrometer.version to align to latest Ref: https://netty.io/news/2023/07/27/4-1-96-Final.html https://mvnrepository.com/artifact/com.linecorp.armeria/armeria/1.24.3
Looks like the time elapsed was 3.054 seconds which is 0.054s more than the test expectations. Not sure if this still in acceptable range. Lines 46 to 61 in d0bdc80
|
@llinder could you please review, thanks! |
Bumps [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) from 3.14.0 to 3.16.3. - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl) - [Commits](protocolbuffers/protobuf@v3.14.0...v3.16.3) --- updated-dependencies: - dependency-name: com.google.protobuf:protobuf-java dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
Trying to see if bumping protobuf CVE issue will help with benchmarks |
Can someone let me know when is this expected to be merged? |
I will be helping with all this stuff this week. Sorry about the neglect experience. let's work together to fix it. @darkmastermindz are you running a zipkin site or is this a hobby effort for you? |
@debraj-manna the project team basically haven't been working out well as this has proven out. I'm going to clean as much of the PR queue as I can, and later raise an issue to help build an on-ramp for new maintainers, who have stake in PRs landing, especially ones like this. Apologies on behalf of this accidental situation... basically I think all the historical maintainers aren't running sites anymore and this is a problem to fix. |
ps if you'd like to rebase with latest armeria (make sure affected versions also match armeria), go for it. Otherwise, I'll help with your branch tomorrow. We'll get this sorted by tomorrow either way. |
working on this now |
I don't have write access to your branch, so I pulled the change into #3614. I dropped the protobuf update as it only affected benchmarks (not production code). I'll update proto in a different PR to latest along with any other deps only used in benchmarks. Thanks again for the help! |
@codefromthecrypt Thanks for the help on this! Apologies for the unresponsiveness as I've been on holiday. This is mostly has become a hobby effort. Previously, I was running zipkin site for an Enterprise organization. Generally, I'm open in helping contribute and help maintain open source telemetry projects. |
Resolves CVE-2023-38493 (Issue #3556)
Bump netty.version to align to latest
Bump jackson.version to align to latest
Bump micrometer.version to align to latest
Ref: https://netty.io/news/2023/07/27/4-1-96-Final.html https://mvnrepository.com/artifact/com.linecorp.armeria/armeria/1.24.3