Update dependency com.hazelcast:hazelcast to v5.3.0 [SECURITY] #120
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
from
a8d5585 to
f2a0d5d
Compare
renovate
bot
changed the title
renovate
bot
deleted the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
renovate
bot
changed the title
renovate
bot
restored the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
renovate
bot
force-pushed
the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
from
f2a0d5d to
a0bece6
Compare
renovate
bot
force-pushed
the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
from
a0bece6 to
e446915
Compare
renovate
bot
force-pushed
the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
from
e446915 to
770eac3
Compare
renovate
bot
force-pushed
the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
from
770eac3 to
9fd2c2d
Compare
renovate
bot
changed the title
renovate
bot
deleted the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/maven-com.hazelcast-hazelcast-vulnerability
branch
from
25865ac to
9fd2c2d
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.1.7->5.3.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-33264
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Release Notes
hazelcast/hazelcast (com.hazelcast:hazelcast)
v5.3.0Compare Source
This document lists the new features, enhancements, fixed issues and, removed or deprecated features for Hazelcast Platform 5.3.0 release. The numbers in the square brackets refer to the issues and pull requests in Hazelcast's GitHub repository.
WARNING: The minimal supported Java version is 11 starting with this release of Hazelcast Platform.
New Features
Breaking Changes
DataLinkFactoryinterface asDataConnection. [#24224]TO_ROWfunction as it is obsolete, you can useCAST (udtObj AS JSON)instead. [#23808]__sql.catalogand__jet.*) cannot be created anymore. [#24282]coordinator.hazelcast.cloudtoapi.viridian.hazelcast.com.The default configuration now connects to https://viridian.hazelcast.com/sign-in?next=/ instead of Hazelcast Cloud.
If you want to continue accessing your Hazelcast Cloud clusters, you need to set the
hazelcast.client.cloud.urlproperty tohttps://coordinator.hazelcast.cloudin your configuration. [#23290]Enhancements
Cloud
service-dns(DNS lookup mode) specified to a Kubernetes cluster.This was causing the requests to be unsuccessful and the application not to start. This mechanism has been improved by creating Kubernetes client only for the DNS lookup mode. [#23883]
for each member's pod. The discovery plugin now matches only the private IP per endpoint, ignoring the port values. [#23766]
Storage
NOTE: Tiered Storage feature is still in BETA stage.
Distribution
ScriptFactorydependency must be explicitly added to the application. [#23355]com.hazelcast.shaded). [#23124]Networking
keep-count,keep-idle-seconds, andkeep-interval-seconds.You can set these options using either the advanced network configurations or Hazelcast system properties.
See Configuring TCP Keep-Alive. [#24050]
SQL Engine
CREATE MAPPINGstatement for Compact Serialization now supports nullable primitives. [#24300]GET_DDLfunction. [#23595]SHOW DATA CONNECTIONSandSHOW RESOURCESstatements to show the connections and resources created by theCREATE CONNECTIONSstatement. [#24028], [#23844]You can also configure this strategy dynamically. [#23535], [#23954]
attributesanduser_defined_typestables toinformation_schema. [#23267]TO_CHARfunction which is capable of formatting dates, timestamps, and numbers. [#22529]JSON=VARCHARcomparison. [#22746]Jet Engine
This has been fixed by introducing a single data connection which can be reused for all job instances. [#23472], [#23849]
JobStatusListeneras an alternative to repeatedly retrieve a job status via theJob.getStatus()method. [#23193]to distinguish the user-cancelled jobs from the failed ones. [#22924]
flockto guard all the concurrentpipexecutions (upgradingpipandprotobufversions) in the Jet-to-Python script. [#22829]Security
keyMaterialDurationwhich allows using a configurable timeout for caching keyStores and trustStores.See [TLS Configuration] for the details on how to configure this property. [#23307]
Serialization
UndefinedErrorCodeException. [#22765]WAN Replication
/hazelcast/rest/wan/sync/progresswhich allows tracking the WAN synchronization progress. [#22958]Connectors
externalName()method. [#23772]the
$functionaggregation method is not supported by the Atlas Serverless instances. In this case, this newly introduced option can be used to to query such instances in one processor. See the option's https://github.com/hazelcast/hazelcast/blob/master/hazelcast-sql/src/main/java/com/hazelcast/jet/sql/impl/connector/mongodb/Options.java#L77. [#24198]jdbc:name inConnectorPermission.The newly introduced checks get the JDBC URL from existing connection metadata and check if the permission is granted. If want to grant a
ConnectorPermissionto all JDBC URLs, you may use wildcards, e.g.,
jdbc:*. [#23716]DataConnectionfor Kafka consumers and producers, and for MongoDB [#23886], [#23837]Metrics
Other Enhancements
external-data-storeconfiguration element asdata-connection. [#24224]testConnectionmethod forJdbcDataConnection). [#23405]Fixes
map.clear()was timing out when the map is configured with a generic map store. [#24534]SELECT COUNT(DISTINCT COLUMN)query for maps was producing incorrect results. [#24464]DELETE FROMorUPDATEfunctions, when used with fully-qualified names, was failing in a JDBC table. [#23476]lastAccessTimeandexpirationTimewas not updated when an entry is accessed viaexecuteOnEntries. [#23926]made by the user was not being reflected. [#23848]
SELECTquery was returning duplicated rows for the mappings in AWS S3 bucket. [#23723]** Not detecting the intent correctly whenever the cluster is shutdown, so the cluster was not restarted successfully.
** Extensive amount of Kubernetes API calls were being logged when Automatic State Management feature is enabled. [#23538]
mapUsingServiceAsyncwas losing items when there are no watermarks. [#23271]hz-clishell script was failing to run in bash on Windows systems since it uses a colon-separatedCLASSPATHwhere each path is a Linux-style path. However, Java on Windows expects a semicolon-separated
CLASSPATHwhere each path is a Windows-style path.As a consequence, the
hz-clicould not be used from bash on Windows. [#22884]SELECT * FROM ...andINSERT INTO <mapping> VALUES. [#22410]in Kubernetes cluster with Istio Envoy Proxy enabled. [#22256]
ForkJoinPool#commonPoolfor internal Hazelcast code, improving stability and avoiding potential deadlocks. [#18190]Contributors
We would like to thank the contributors from our open source community
who worked on this release:
v5.2.5Compare Source
This document lists the enhancements and fixed issues for the Hazelcast Platform 5.2.5 release. The numbers in the square brackets refer to the issues and pull requests in Hazelcast's GitHub repository.
Enhancements
** Snappy to 1.1.10.5
** gRPC to 1.59
** Netty to 4.1.100.Final
** Elasticsearch to 7.17.13
** Everit JSON Schema to 1.14.3
[#24866], [#25820], [#25708], [#25729], [#25775]
Fixes
hazelcast-service-port, caused member auto-discovery for embedded deployments to fail. [#24841]Removed/Deprecated Features
Contributors
We would like to thank the contributors from our open source community
who worked on this release:
v5.2.4Compare Source
This document lists the enhancements and fixed issues for the Hazelcast Platform 5.2.4 release. The numbers in the square brackets refer to the issues and pull requests in Hazelcast's GitHub repository (github.com/hazelcast/hazelcast).
Enhancements
jackson-coredependency to 2.15.2. [#24730]service-dns(DNS lookup mode) specified to a Kubernetes cluster. This was causing the requests to be unsuccessful and the application not to start. This mechanism has been improved by creating Kubernetes client only for the DNS lookup mode. [#24045]Fixes
lastAccessTimeandexpirationTimewas not updated when an entry is accessed viaexecuteOnEntries. [#24012]v5.2.3Compare Source
This document lists the enhancements and fixes for Hazelcast Platform 5.2.3 release. The numbers in the square brackets refer to the issues and pull requests in Hazelcast's GitHub repository.
Enhancements
for each member's pod. The discovery plugin now matches only the private IP per endpoint, ignoring the port values. [#23931]
hazelcast.discovery.public.address.fallbackproperty to enable smart clientconnectivity to Hazelcast clusters deployed on Kubernetes, and having advanced network configuration enabled.[#23920]
Fixes
Failed to configure discovery strategieserror. [#23939]v5.2.2Compare Source
This document lists the new features, enhancements, fixed issues and, removed or deprecated features for Hazelcast Platform 5.2.2 release. The numbers in square brackets refer to the pull requests in Hazelcast's GitHub repository.
Breaking Changes
coordinator.hazelcast.cloudtoapi.viridian.hazelcast.com.When you use the default configuration, it now connects to Hazelcast Viridian instead of Hazelcast Cloud, potentially leading to not being able to connect to the cloud cluster. If you want to use Hazelcast Cloud, you need to change the value of
hazelcast.client.cloud.urlproperty tohttps://coordinator.hazelcast.cloud. [#23304]Enhancements
flockto guard concurrentpipruns. [#22934]Fixes
HazelcastJsonValue. [#23453]mapUsingServiceAsync()was losing the last items when there are no watermarks. [#23272]For short jobs, the job might have been completed even before recording the
startTimemetric; since this metric is collected after the job is submitted.Now, this metric is collected just before submitting a job. [#23066]
v5.2.1Compare Source
This document lists the new features, enhancements, fixed issues and, removed or deprecated features for Hazelcast Platform 5.2.1 releases. The numbers in the square brackets refer to the issues and pull requests in Hazelcast's GitHub repository.
Enhancements
Fixes
map.set()when map store offloading is enabled. [#22603]v5.2.0Compare Source
This document lists the new features, enhancements, fixed issues and, removed or deprecated features for Hazelcast Platform 5.2.0 release. The numbers in the square brackets refer to the issues and pull requests in Hazelcast's GitHub repository.
New Features
MapStoreorMapLoaderinterfaces.There are cases when some CP members should not act as a leader. For example, a member with high load would not be a good leader, or, in a WAN deployment, members in a primary datacenter may be preferred in order to minimize the latency between the clients and leader. You can transfer the leadership using the
cp-member-priorityconfiguration element. See Configuring Leadership Priority.Breaking Changes
BETAannotations from the compact serialization andGenericRecordrelated classes, i.e., they are stable. Now, compact serialization is enabled by default; theenabledattribute within thecompact-serializationconfiguration block does not exist anymore. [#21997]Enhancements
Performance
offloadelement to map store configuration. It is used to offload map store and loader operations for each map in the cluster. This way, a map store operation does not block the next operations by blocking a partition thread indefinitely. Partition threads are one of the most important shared resources in a cluster; this offloading enables faster completion of the operations in these threads.See Offloading MapStore and MapLoader Operations. [#21651]
SQL Engine
Distribution
hazelcast-hibernate53dependency from the main Hazelcast Platform distribution as it is not needed anymore. [#22282]Serialization
Added support of
List,ArrayList,Set,HashSet,Map, andHashMapfor the zero-config serializers. [#21980]Added a check to the array of
CompactandGenericRecordobject fields, that does not allow different item types and schemas in such fields. [#21958]Moved the
GenericRecordandGenericRecordBuilderinterfaces to the newserialization.genericrecordpackage. [#21955]In case there is a field type that is not supported by the reflective serializer, now Hazelcast fails with an exception; all JDK classes are now excluded from the zero-config serialization, meaning, they cannot be used as types, field types, or array component types in the reflective serializers. [#21918]
Hazelcast now does not provide methods to read a default value in case of a missing field in the data. Instead, the following method has been introduced in
CompactReaderto check the existence of a field with its name and kind.+FieldKind getFieldKind(String fieldName);
You can use this method for fields that have changed or have a potential to change in the future. [#21876]
Moved the
type-nameandclassconfiguration elements into thecompact-serializationblock. Removed theregistered-classeselement. [#21861]Renamed the
cloneWithBuilder()method asnewBuilderWithClone()in theGenericRecordclass. [#21730]Added support for
charfields in the compact serialization format. With this,char,char[],Character, andCharacter[]fields are now supported in the reflective compact serializers. [#21054]Configuration
For this purpose,
AwsConfigis extended with an additionalexecutorServiceSupplierfield that allows to specify what executor service to be used. [#21075]Other Enhancements
service-label-name,service-label-value,pod-label-name, andpod-label-value. [#22277]See https://docs.hazelcast.org/docs/5.2.0/javadoc/com/hazelcast/map/ExtendedMapEntry.html#setValueWithoutChangingExpiryTime-V-. [#22199]
newValue()andoldValue(), to compare values before and after an update of a record.ParsingExceptionand you don't have to deal with those possible exceptions.Stringwith class name, to make the code more strongly-typed.[#21536]
DEBUG. When you need these metrics, you can use thehazelcast.metrics.debug.enabled] property. [#21232]hazelcast.disable.docker.testsproperty to ignore the tests that require Docker to run (by setting it tofalse). [#21087]hazelcast/rest/config/tcp-ip/member-list) is introduced for getting and updating the member list at runtime.This improves the split-brain recovery under even certain corner cases and ensures that the cluster recovery from split-brain in every cluster setup can be initially formed. [#20552]
Fixes
IS NULLcondition was being ignored when there is another condition for the same column. [#22238]IMap.get()call was blocked whenNoNodeAvailableExceptionis thrown from the MapStore. [#22168]ClearBackupOperationin maps was being reported as a slow operation on the members which was causing the entire cluster to be frozen. [#22082][#21705]
NullPointerExceptionwas thrown around theCREATE JOBstatement which is using Kafka Sink connector when Kafka has no records yet. Now, it produces an appropriate log message. [#21460]max-idle-secondsconfiguration has the value ofInteger.MAX_VALUE. [#21409]REPLICA_NOT_SYNCstate during such health checks. [#21145]expired when you want to get this entry at 01:01:6.01 AM (should have been expired at 01:01:6.99 AM). [#21018]
SingleProtocolEncoder; while one method of this interface is called from the input thread, another one is called from the output thread which was causing the race. [#20991]hazelcast-5.x.jarcould not be detected using Gradle. The reason was/META-INF/MANIFEST.MFnot being the first or second entry in the JAR file; now this manifest file is the second entry. [#20969]JSON_QUERYwith expression filter in SQL was not producing a result when the data source contains internal array(s). [#20761]java.util.Map, theCREATE MAPPINGstatement was failing. [#20256]Contributors
We would like to thank the contributors from our open source community
who worked on this release:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.