[SPARK-53436][BUILD] Upgrade Netty to 4.1.124.Final
#52181
Conversation
|
@dongjoon-hyun https://www.cve.org/CVERecord?id=CVE-2025-55163 so I hope to get this into 4.0.1 |
bjornjorgensen
changed the title
Netty to 4.1.124.Final
bjornjorgensen
changed the title
Netty to 4.1.124.FinalNetty to 4.1.124.Final
There was a problem hiding this comment.
Thank you for pinging me, @bjornjorgensen . It looks good for Apache Spark 4.1.0.
However, I don't think this is a blocker for 4.0.1. When it comes to new Netty dependency changes, we need to be very careful and more conservative on validation always because it affects Spark performance significantly.
For example, Apache Spark 4.0.x is still using 4.1.118.Final while Apache Spark 4.1.x
branch-4.0
Line 218 in 3f03a1c
master
Line 219 in 59b34dc
I also didn't backport the following my PRs too intentionally due to the same reasons.
We can land it to master branch first (if CI passes) and may revisit Netty at 4.0.2, @bjornjorgensen .
|
OK, thank you. |
What changes were proposed in this pull request?
Upgrade Netty from 4.1.123 to 4.1.124
Why are the changes needed?
Bug fixs and GHSA-prj3-ccx8-p6x4
Netty 4.1.124.Final released
Does this PR introduce any user-facing change?
No.
How was this patch tested?
Pass CI/CD tests.
Was this patch authored or co-authored using generative AI tooling?
No.