From b7e961b232b4f5cb89d80518e334998e632879ee Mon Sep 17 00:00:00 2001 From: kezhenxu94 Date: Wed, 12 Feb 2025 12:46:26 +0800 Subject: [PATCH] Bump up netty to 4.11.118 and a bunch of GHA to fix CVE-2025-24970 (#13027) --- .github/workflows/codeql.yaml | 2 +- .github/workflows/dead-link-checker.yaml | 2 +- .../workflows/publish-docker-e2e-service.yaml | 6 +-- .github/workflows/publish-docker.yaml | 8 ++-- .github/workflows/skywalking.yaml | 44 +++++++++---------- README.md | 2 +- dist-material/release-docs/LICENSE | 43 +++++++++--------- docs/en/changes/changes.md | 1 + pom.xml | 2 +- 9 files changed, 56 insertions(+), 54 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index a547a09ac6..aae0290199 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -48,7 +48,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: submodules: true diff --git a/.github/workflows/dead-link-checker.yaml b/.github/workflows/dead-link-checker.yaml index 10fd1fa878..b134daf300 100644 --- a/.github/workflows/dead-link-checker.yaml +++ b/.github/workflows/dead-link-checker.yaml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - run: sudo npm install -g markdown-link-check@3.10.0 - run: | for file in $(find . -name "*.md"); do diff --git a/.github/workflows/publish-docker-e2e-service.yaml b/.github/workflows/publish-docker-e2e-service.yaml index 4474fd7087..4c13130f2f 100644 --- a/.github/workflows/publish-docker-e2e-service.yaml +++ b/.github/workflows/publish-docker-e2e-service.yaml @@ -39,7 +39,7 @@ jobs: env: TAG: ${{ github.sha }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Cache local Maven repository @@ -56,8 +56,8 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set up QEMU - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@v3 - name: Build and push images run: make -C test build.e2e-service docker.push-e2e-service diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml index badf956aae..2332526f16 100644 --- a/.github/workflows/publish-docker.yaml +++ b/.github/workflows/publish-docker.yaml @@ -36,7 +36,7 @@ jobs: packages: write timeout-minutes: 90 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Cache local Maven repository @@ -65,15 +65,15 @@ jobs: echo "TAG=${{ github.sha }}" >> $GITHUB_ENV fi - name: Log in to the Container registry - uses: docker/login-action@v2 + uses: docker/login-action@v3 with: registry: ${{ env.DOCKER_REGISTRY }} username: ${{ env.DOCKER_USERNAME }} password: ${{ env.DOCKER_PASSWORD }} - name: Set up QEMU - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@v3 - name: Build and push docker images based on Java 17 env: SW_OAP_BASE_IMAGE: eclipse-temurin:17-jre diff --git a/.github/workflows/skywalking.yaml b/.github/workflows/skywalking.yaml index 7d14091b84..4461c5e8d6 100644 --- a/.github/workflows/skywalking.yaml +++ b/.github/workflows/skywalking.yaml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Check license header @@ -49,7 +49,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Check code style @@ -64,16 +64,16 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4 with: distribution: "temurin" java-version: "11" cache: "maven" - name: Setup Go - uses: actions/setup-go@v3 + uses: actions/setup-go@v5 with: go-version: "1.17" - name: Check Dependencies Licenses @@ -111,7 +111,7 @@ jobs: pom: ${{ steps.filter-pom.outputs.any_modified }} ui: ${{ steps.filter-ui.outputs.any_modified }} steps: - - uses: actions/checkout@v3 # required for push event + - uses: actions/checkout@v4 # required for push event with: fetch-depth: 0 submodules: true @@ -166,10 +166,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4 with: distribution: "temurin" java-version: "11" @@ -200,7 +200,7 @@ jobs: matrix: java-version: [11, 17] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - uses: actions/download-artifact@v4 @@ -209,7 +209,7 @@ jobs: name: dist path: dist - name: Set up Java - uses: actions/setup-java@v3 + uses: actions/setup-java@v4 with: distribution: temurin java-version: ${{ matrix.java-version }} @@ -244,7 +244,7 @@ jobs: - os: ubuntu-latest java-version: 21 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Cache maven repository @@ -253,7 +253,7 @@ jobs: path: ~/.m2/repository key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} restore-keys: ${{ runner.os }}-maven- - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4 with: java-version: ${{ matrix.java-version }} distribution: temurin @@ -272,7 +272,7 @@ jobs: matrix: java-version: [11, 17, 21] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Cache maven repository @@ -281,7 +281,7 @@ jobs: path: ~/.m2/repository key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} restore-keys: ${{ runner.os }}-maven- - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4 with: java-version: ${{ matrix.java-version }} distribution: temurin @@ -306,7 +306,7 @@ jobs: - name: ElasticSearch / OpenSearch class: org.apache.skywalking.library.elasticsearch.ElasticSearchIT steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - name: Cache maven repository @@ -315,7 +315,7 @@ jobs: path: ~/.m2/repository key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} restore-keys: ${{ runner.os }}-maven- - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4 with: java-version: 11 distribution: temurin @@ -696,7 +696,7 @@ jobs: - name: Async Profiler MySQL config: test/e2e-v2/cases/profiling/async-profiler/mysql/e2e.yaml steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - uses: actions/download-artifact@v4 @@ -709,7 +709,7 @@ jobs: find docker-images -name "*.tar" -exec docker load -i {} \; find docker-images -name "*.tar" -exec rm {} \; - name: Login to ghcr - uses: docker/login-action@v1 + uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -770,7 +770,7 @@ jobs: kubernetes: 28 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - uses: actions/download-artifact@v4 @@ -783,7 +783,7 @@ jobs: find docker-images -name "*.tar" -exec docker load -i {} \; find docker-images -name "*.tar" -exec rm {} \; - name: Login to ghcr - uses: docker/login-action@v1 + uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -821,7 +821,7 @@ jobs: matrix: java-version: [11, 17] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: true - uses: actions/download-artifact@v4 @@ -833,7 +833,7 @@ jobs: run: | find docker-images -name "*.tar" -exec docker load -i {} \; find docker-images -name "*.tar" -exec rm {} \; - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4 with: java-version: ${{ matrix.java-version }} distribution: temurin diff --git a/README.md b/README.md index 21d8b8d46c..e4058e7632 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ Apache SkyWalking microservices, cloud native and container-based architectures. [![GitHub stars](https://img.shields.io/github/stars/apache/skywalking.svg?style=for-the-badge&label=Stars&logo=github)](https://github.com/apache/skywalking) -[![Twitter Follow](https://img.shields.io/twitter/follow/asfskywalking.svg?style=for-the-badge&label=Follow&logo=twitter)](https://twitter.com/AsfSkyWalking) +[![X Follow](https://img.shields.io/badge/2K%2B-follow?style=for-the-badge&logo=X&label=%40ASFSKYWALKING)](https://x.com/AsfSkyWalking) [![Maven Central](https://img.shields.io/maven-central/v/org.apache.skywalking/apache-skywalking-apm.svg)](http://skywalking.apache.org/downloads/) diff --git a/dist-material/release-docs/LICENSE b/dist-material/release-docs/LICENSE index d6fd81e1f9..81ba28bf87 100644 --- a/dist-material/release-docs/LICENSE +++ b/dist-material/release-docs/LICENSE @@ -303,28 +303,29 @@ The text of each license is the standard Apache 2.0 license. https://mvnrepository.com/artifact/io.micrometer/micrometer-commons/1.13.0 Apache-2.0 https://mvnrepository.com/artifact/io.micrometer/micrometer-core/1.13.0 Apache-2.0 https://mvnrepository.com/artifact/io.micrometer/micrometer-observation/1.13.0 Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-buffer/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-codec/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-codec-dns/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-codec-haproxy/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-codec-socks/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-common/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-handler/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-handler-proxy/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-resolver/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-resolver-dns/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-classes-macos/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-native-macos/4.1.115.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-buffer/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-codec/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-codec-dns/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-codec-haproxy/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-codec-http/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-codec-socks/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-common/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-handler/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-handler-proxy/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-resolver/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-resolver-dns/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-classes-macos/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-resolver-dns-native-macos/4.1.118.Final Apache-2.0 https://mvnrepository.com/artifact/io.netty/netty-tcnative-boringssl-static/2.0.69.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-tcnative-classes/2.0.69.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-transport/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-transport-classes-epoll/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-transport-classes-kqueue/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-transport-native-epoll/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-transport-native-kqueue/4.1.115.Final Apache-2.0 - https://mvnrepository.com/artifact/io.netty/netty-transport-native-unix-common/4.1.115.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-tcnative-boringssl-static/2.0.70.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-tcnative-classes/2.0.70.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-transport/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-transport-classes-epoll/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-transport-classes-kqueue/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-transport-native-epoll/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-transport-native-kqueue/4.1.118.Final Apache-2.0 + https://mvnrepository.com/artifact/io.netty/netty-transport-native-unix-common/4.1.118.Final Apache-2.0 https://mvnrepository.com/artifact/io.perfmark/perfmark-api/0.27.0 Apache-2.0 https://mvnrepository.com/artifact/io.prometheus/simpleclient/0.6.0 Apache-2.0 https://mvnrepository.com/artifact/io.prometheus/simpleclient_common/0.6.0 Apache-2.0 diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md index 3878e48c47..e226fb0424 100644 --- a/docs/en/changes/changes.md +++ b/docs/en/changes/changes.md @@ -69,6 +69,7 @@ * Add `Get Node List in the Cluster` API. * Add type descriptor when converting Envoy logs to JSON for persistence, to avoid conversion error. * Bseline: Support query baseline with MQE and use in the Alarm Rule. +* Bump up netty to 4.11.118 to fix CVE-2025-24970. #### UI diff --git a/pom.xml b/pom.xml index ac4b1862ee..66b2e538f8 100755 --- a/pom.xml +++ b/pom.xml @@ -166,7 +166,7 @@ 1.68.1 - 4.1.115.Final + 4.1.118.Final 2.0.69.Final 2.9.0 1.6.2