nikolasten opened a new pull request, #125:
URL: https://github.com/apache/flink-connector-pulsar/pull/125
## Purpose of the change
Upgrade the bundled `pulsar-client-all` from 3.0.5 to the latest 3.0.x
patch, 3.0.17, to clear two critical CVEs carried by its shaded dependencies:
avro (CVE-2023-39410, GHSA-r7pg-v2c8-mfg3) and async-http-client
(CVE-2024-53990, GHSA-mfj5-cf8g-g2fv).
A straight version bump breaks at runtime: the connector queries topic
metadata through the internal
`PulsarClientImpl.getPartitionedTopicMetadata(String)`, which was removed in
pulsar-client 3.0.8, causing `NoSuchMethodError` in both the source enumerator
and the sink metadata listener. This change first moves those call sites to the
public `PulsarClient` API so the connector no longer depends on the
implementation class, then performs the upgrade.
## Brief change log
- Query topic metadata via the public
`PulsarClient.getPartitionsForTopic(String)` instead of the internal
`PulsarClientImpl.getPartitionedTopicMetadata(String)`, in
`BasePulsarSubscriber` (source enumerator) and `MetadataListener` (sink).
`getPartitionsForTopic` returns the topic name itself for a non-partitioned
topic and the partition names otherwise, so non-partitioned topics are detected
via `TopicName#isPartitioned` on the first returned entry, preserving the
previous `NON_PARTITIONED` semantics and caching behaviour.
- Bump `pulsar.version` 3.0.5 -> 3.0.17.
- Bump `jackson-bom.version` 2.13.4 -> 2.17.3 to match the jackson-databind
shaded into `pulsar-client-all` 3.0.17: its shaded `EnumDeserializer`
references `JsonFormat.Feature.READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE`,
which only exists in jackson-annotations 2.15+, so client creation otherwise
fails with `NoSuchFieldError`.
## Verifying this change
This change is already covered by existing tests that resolve topic metadata
for both partitioned and non-partitioned topics against a real Pulsar broker,
such as `PulsarSubscriberTest`, `PulsarSourceITCase`, `PulsarSinkITCase`, and
the metadata-listener / split-reader reader tests. No behavioural change is
expected — only the underlying client call and the dependency versions change.
## Significant changes
- [x] Dependencies have been added or upgraded
- [ ] Public API has been changed (Public API is any class annotated with
`@Public(Evolving)`)
- [ ] Serializers have been changed
- [ ] New feature has been introduced
- If yes, how is this documented? (not applicable / docs / JavaDocs /
not documented)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
