[
https://issues.apache.org/jira/browse/FLINK-33505?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18092059#comment-18092059
]
PJ Fanning commented on FLINK-33505:
------------------------------------
Closing. Flink git repo main branch uses Pekko 1.6.0 so you already use Pekko's
Netty 4 support.
> switch away from using netty 3 based Pekko Classic Remoting
> -----------------------------------------------------------
>
> Key: FLINK-33505
> URL: https://issues.apache.org/jira/browse/FLINK-33505
> Project: Flink
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
>
> It is my understanding that Flink uses the Netty 3 based Pekko Classic
> Remoting.
> Netty 3 has a lot of security issues.
> It will be months before Pekko 1.1.0 is released but that switches Classic
> Remoting to use Netty 4.
> Akka and Pekko actually recommend that users switch to using Artery based
> communications.
> Even if you wait for Pekko 1.1.0, the new Netty 4 based classic remoting will
> need to be tested.
> There is also the option of dropping Pekko - FLINK-29281
> If you don't want to try Artery and don't want to wait for Pekko 1.1.0, you
> might be able to copy over 5 classes that add Netty 4 support and update your
> application.conf. This would be approximately
> https://github.com/apache/incubator-pekko/pull/778. There is a bit more work
> to do in terms of debugging the test failure and it seems that this change is
> unlikely to be merged back to the Pekko 1.0.x line.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
