Release version 1.3.5

Update log4j to 2.17.1 to address CVE-2021-44832 (#227 )
Update log4j to 2.17 to address CVE-2021-45105. (#226 )
2026-11-10 03:41:25 -10:00 · 2022-01-07 14:40:06 -05:00 · 2021-12-30 13:50:34 -05:00 · 2021-12-20 10:44:47 -05:00 · 2021-12-15 16:59:06 -05:00 · 2021-12-15 16:53:24 -05:00
25 changed files with 156 additions and 62 deletions
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>timely-analytics</artifactId>
  <!--
@@ -169,6 +169,12 @@
                </excludes>
              </artifactSet>
              <filters>
+                <filter>
+                  <artifact>*:*</artifact>
+                  <excludes>
+                    <exclude>**/module-info.class</exclude>
+                  </excludes>
+                </filter>
                <filter>
                  <artifact>org.apache.flink:*</artifact>
                  <excludes>
@@ -246,6 +252,14 @@
                  <artifactSet>
                    <excludes combine.self="override" />
                  </artifactSet>
+                  <filters>
+                    <filter>
+                      <artifact>*:*</artifact>
+                      <excludes>
+                        <exclude>**/module-info.class</exclude>
+                      </excludes>
+                    </filter>
+                  </filters>
                </configuration>
              </execution>
            </executions>
@@ -15,4 +15,12 @@
    <Method name="getMetrics" />
    <Bug pattern="EI_EXPOSE_REP" />
  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP2" />
+  </Match>
 </FindBugsFilter>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>timely-balancer</artifactId>
  <dependencies>
@@ -10,4 +10,12 @@
    <Method name="getBuf" />
    <Bug pattern="EI_EXPOSE_REP" />
  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP2" />
+  </Match>
 </FindBugsFilter>
@@ -4,13 +4,13 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>timely-client</artifactId>
  <properties>
    <!-- PEP 440 compliant version gets substituted into src/main/python/template/setup.py -->
    <!-- use .dev0 instead of -SNAPSHOT -->
-    <python.client.version>1.3.4</python.client.version>
+    <python.client.version>1.3.5</python.client.version>
  </properties>
  <dependencies>
    <dependency>
@@ -10,4 +10,16 @@
    <!-- https://github.com/spotbugs/spotbugs/issues/756 -->
    <Bug pattern="RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE" />
  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="MS_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP2" />
+  </Match>
 </FindBugsFilter>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>collectd-nsq-plugin</artifactId>
  <dependencies>
@@ -34,6 +34,14 @@
          <artifactSet>
            <includes />
          </artifactSet>
+          <filters>
+            <filter>
+              <artifact>*:*</artifact>
+              <excludes>
+                <exclude>**/module-info.class</exclude>
+              </excludes>
+            </filter>
+          </filters>
          <createDependencyReducedPom>false</createDependencyReducedPom>
        </configuration>
        <executions>
@@ -88,12 +88,10 @@ public class WriteNSQPlugin extends CollectDPluginParent
            if (client != null) {
                clientPool.returnObject(client);
            }
-            if (null != out) {
                try {
                    out.close();
                } catch (IOException e) {
                }
-            }
        }
        return 0;
    }
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>collectd-plugin-parent</artifactId>
  <dependencies>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>collectd-timely-plugin</artifactId>
  <dependencies>
@@ -51,6 +51,14 @@
          <artifactSet>
            <includes />
          </artifactSet>
+          <filters>
+            <filter>
+              <artifact>*:*</artifact>
+              <excludes>
+                <exclude>**/module-info.class</exclude>
+              </excludes>
+            </filter>
+          </filters>
          <createDependencyReducedPom>false</createDependencyReducedPom>
        </configuration>
        <executions>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>timely-common</artifactId>
  <dependencies>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>grafana-auth</artifactId>
  <dependencies>
@@ -5,4 +5,18 @@
    <Method name="getBuf" />
    <Bug pattern="EI_EXPOSE_REP" />
  </Match>
+  <Match>
+    <!-- this is bad practice, but changing it would change behavior; probably needs more triage -->
+    <Class name="timely.grafana.auth.netty.http.GrafanaRequestDecoder" />
+    <Method name="decode" />
+    <Bug pattern="DCN_NULLPOINTER_EXCEPTION" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP2" />
+  </Match>
 </FindBugsFilter>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>timely-app</artifactId>
  <packaging>pom</packaging>
@@ -28,8 +28,8 @@
      }
    ],
    "screenshots": [],
-    "version": "1.3.4",
-    "updated": "2021-11-01"
+    "version": "1.3.5",
+    "updated": "2022-01-07"
  },
  "dependencies": {
    "classnames": "2.2.6",
@@ -1,6 +1,6 @@
 {
  "name": "timely-datasource",
-  "version": "1.3.4",
+  "version": "1.3.5",
  "description": "Timely",
  "backend": true,
  "alerting": true,
@@ -20,7 +20,7 @@
    "node": ">=12 <13"
  },
  "dependencies": {
-    "@grafana/data": "8.2.2",
+    "@grafana/data": "8.2.3",
    "@grafana/runtime": "8.2.2",
    "@grafana/slate-react": "0.22.10-grafana",
    "@grafana/ui": "8.2.2",
@@ -1052,6 +1052,21 @@
    rxjs "7.3.0"
    xss "1.0.6"

+"@grafana/[email protected]":
+  version "8.2.3"
+  resolved "https://registry.yarnpkg.com/@grafana/data/-/data-8.2.3.tgz#e50deab3f5b7c097246e1cf5279a16f28b8f9a4b"
+  integrity sha512-7c0gNMm63sPgpFWyNNhGYZ0n/VRoQVKVb/XURJD7JNrkZQ1kxPTYjPaEw4FR5vuSSCEZXYU5EDqcBxMi01Rb+Q==
+  dependencies:
+    "@braintree/sanitize-url" "5.0.2"
+    "@grafana/schema" "8.2.3"
+    "@types/d3-interpolate" "^1.3.1"
+    date-fns "2.21.3"
+    eventemitter3 "4.0.7"
+    lodash "4.17.21"
+    marked "2.0.1"
+    rxjs "7.3.0"
+    xss "1.0.6"
+
 "@grafana/[email protected]":
  version "8.2.2"
  resolved "https://registry.yarnpkg.com/@grafana/e2e-selectors/-/e2e-selectors-8.2.2.tgz#67e758f458f3e457dbeb4a1b1761d6841e95fa61"
@@ -1096,6 +1111,11 @@
  resolved "https://registry.yarnpkg.com/@grafana/schema/-/schema-8.2.2.tgz#b0b680d8177157f8abd4420d51cc320c4023c686"
  integrity sha512-6fsovAYfFJcm0+E0/ZUjIHjrWiDvHdD+MRK6dNJEzaWFC2wngQAkeN+q7HkZ9AwC8c11rSRZI7Y4CaQJp8DXcA==

+"@grafana/[email protected]":
+  version "8.2.3"
+  resolved "https://registry.yarnpkg.com/@grafana/schema/-/schema-8.2.3.tgz#77b4f289ae10b60ab52593a6c373c988ec2aa48d"
+  integrity sha512-JcIAy/WdAP81zXuJMYa8uXdWQOfSu3gPO73uiK1R6Zpz3CCUGVpR4Lla1+14VMjbVk+AwxYsoNUDptQPxnrpDw==
+
 "@grafana/[email protected]":
  version "0.22.10-grafana"
  resolved "https://registry.yarnpkg.com/@grafana/slate-react/-/slate-react-0.22.10-grafana.tgz#53653bbef73530334a2db284129ccd0dfd682fef"
@@ -3,7 +3,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>timely</groupId>
  <artifactId>timely</artifactId>
-  <version>1.3.4</version>
+  <version>1.3.5</version>
  <packaging>pom</packaging>
  <name>Timely</name>
  <description>A secure and scalable time series database based on Apache Accumulo</description>
@@ -58,7 +58,7 @@
    <version.guava>29.0-jre</version.guava>
    <version.hadoop>2.7.7</version.hadoop>
    <version.httpcomponents>4.5.13</version.httpcomponents>
-    <version.impsort>1.4.1</version.impsort>
+    <version.impsort>1.6.2</version.impsort>
    <version.jackson>2.10.0</version.jackson>
    <version.jackson.databind>2.10.0</version.jackson.databind>
    <version.jacoco>0.8.4</version.jacoco>
@@ -68,7 +68,7 @@
    <version.jjwt>0.11.2</version.jjwt>
    <version.jsoup>1.14.2</version.jsoup>
    <version.junit>4.13.1</version.junit>
-    <version.log4j>2.13.3</version.log4j>
+    <version.log4j>2.17.1</version.log4j>
    <version.maven-assembly>3.1.1</version.maven-assembly>
    <version.maven-build-helper>3.0.0</version.maven-build-helper>
    <version.maven-compiler>3.8.1</version.maven-compiler>
@@ -83,12 +83,27 @@
    <version.os-maven>1.5.0.Final</version.os-maven>
    <version.powermock>1.6.4</version.powermock>
    <version.slf4j>1.7.26</version.slf4j>
-    <version.spotbugs-maven>4.0.0</version.spotbugs-maven>
+    <version.spotbugs-maven>4.5.0.0</version.spotbugs-maven>
    <version.spring-boot>2.1.3.RELEASE</version.spring-boot>
    <version.tyrus>1.15</version.tyrus>
  </properties>
  <dependencyManagement>
    <dependencies>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-bom</artifactId>
+        <version>${version.log4j}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <!-- Import dependency management from Spring Boot -->
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-dependencies</artifactId>
+        <version>${version.spring-boot}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-annotations</artifactId>
@@ -365,38 +380,12 @@
        <version>${version.disruptor}</version>
        <scope>runtime</scope>
      </dependency>
-      <dependency>
-        <groupId>org.apache.logging.log4j</groupId>
-        <artifactId>log4j-api</artifactId>
-        <version>${version.log4j}</version>
-        <scope>runtime</scope>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.logging.log4j</groupId>
-        <artifactId>log4j-core</artifactId>
-        <version>${version.log4j}</version>
-        <scope>runtime</scope>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.logging.log4j</groupId>
-        <artifactId>log4j-slf4j-impl</artifactId>
-        <version>${version.log4j}</version>
-        <scope>runtime</scope>
-      </dependency>
      <dependency>
        <groupId>org.javassist</groupId>
        <artifactId>javassist</artifactId>
        <version>${version.javassist}</version>
        <scope>runtime</scope>
      </dependency>
-      <dependency>
-        <!-- Import dependency management from Spring Boot -->
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-dependencies</artifactId>
-        <version>${version.spring-boot}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
      <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
@@ -448,15 +437,17 @@
        <plugin>
          <groupId>com.github.ekryd.sortpom</groupId>
          <artifactId>sortpom-maven-plugin</artifactId>
-          <version>2.10.0</version>
+          <version>3.0.0</version>
          <configuration>
-            <predefinedSortOrder>recommended_2008_06</predefinedSortOrder>
            <createBackupFile>false</createBackupFile>
-            <lineSeparator>\n</lineSeparator>
            <expandEmptyElements>false</expandEmptyElements>
+            <keepBlankLines>false</keepBlankLines>
+            <lineSeparator>\n</lineSeparator>
            <nrOfIndentSpace>2</nrOfIndentSpace>
+            <predefinedSortOrder>recommended_2008_06</predefinedSortOrder>
            <sortDependencies>scope,groupId,artifactId</sortDependencies>
            <sortProperties>true</sortProperties>
+            <spaceBeforeCloseEmptyElement>true</spaceBeforeCloseEmptyElement>
            <verifyFail>Stop</verifyFail>
          </configuration>
        </plugin>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.4</version>
+    <version>1.3.5</version>
  </parent>
  <artifactId>timely-server</artifactId>
  <dependencies>
@@ -4,6 +4,8 @@ import java.io.Serializable;

 public class TimelyExceptionResponse implements Serializable {

+    private static final long serialVersionUID = 8951492383251242114L;
+
    public String message;
    public String detailMessage;
    public int responseCode;
@@ -41,7 +41,7 @@ public class JWTTokenHandler {
        if (StringUtils.isNotBlank(security.getJwtCheckKeyStore())) {
            try {
                String type = security.getJwtCheckKeyType();
-                if (type.equals("X.509")) {
+                if (type != null && type.equals("X.509")) {
                    CertificateFactory factory = CertificateFactory.getInstance("X.509");
                    InputStream is = ResourceUtils.getURL(security.getJwtCheckKeyStore()).openStream();
                    X509Certificate certificate = (X509Certificate) factory.generateCertificate(is);
@@ -483,7 +483,6 @@ public class DataStoreImpl implements DataStore {
    @Override
    public SuggestResponse suggest(SuggestRequest request) throws TimelyException {
        SuggestResponse result = new SuggestResponse();
-        Scanner scanner = null;
        try {
            Optional<String> metricOpt = request.getMetric();
            if (request.getType().equals("metrics")) {
@@ -533,10 +532,6 @@ public class DataStoreImpl implements DataStore {
            LOG.error("Error during suggest: " + ex.getMessage(), ex);
            throw new TimelyException(HttpResponseStatus.INTERNAL_SERVER_ERROR.code(),
                    "Error during suggest: " + ex.getMessage(), ex.getMessage(), ex);
-        } finally {
-            if (scanner != null) {
-                scanner.close();
-            }
        }
        return result;
    }
@@ -23,4 +23,22 @@
    <Method name="&lt;init&gt;" />
    <Bug pattern="REC_CATCH_EXCEPTION" />
  </Match>
+  <Match>
+    <!-- this is bad practice, but changing it would change behavior; probably needs more triage -->
+    <Class name="timely.netty.http.HttpRequestDecoder" />
+    <Method name="decode" />
+    <Bug pattern="DCN_NULLPOINTER_EXCEPTION" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="MS_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP" />
+  </Match>
+  <Match>
+    <!-- these are probably avoidable, but needs further triage to fix -->
+    <Bug pattern="EI_EXPOSE_REP2" />
+  </Match>
 </FindBugsFilter>
@@ -34,7 +34,7 @@ public class TestGorillaStore {
        gStore.addValue(now += 100, 1.2345);

        List<WrappedGorillaDecompressor> decompressorList = gStore.getDecompressors(0, Long.MAX_VALUE);
-        Pair pair = null;
+        Pair pair;
        for (WrappedGorillaDecompressor w : decompressorList) {
            while ((pair = w.readPair()) != null) {
                System.out.println(pair.getTimestamp() + " --> " + pair.getDoubleValue());
@@ -2,7 +2,6 @@ package timely.store.compaction;

 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;

 import java.util.Arrays;
@@ -16,7 +15,6 @@ import org.apache.accumulo.core.data.TabletId;
 import org.apache.accumulo.core.util.ComparablePair;
 import org.apache.hadoop.io.Text;
 import org.easymock.EasyMock;
-import org.hamcrest.CoreMatchers;
 import org.junit.Test;

 public class TabletRowAdapterTest {
@@ -72,8 +70,8 @@ public class TabletRowAdapterTest {
        EasyMock.replay(tid);

        String debug = TabletRowAdapter.toDebugOutput(tid);
-        assertThat(debug, CoreMatchers.containsString("prefix: sys.disk.disk_octets"));
-        assertThat(debug, CoreMatchers.containsString("date: 2019-04-11T05:59:42.848"));
-        assertThat(debug, CoreMatchers.containsString("millis: 1554962382848"));
+        assertTrue(debug, debug.contains("prefix: sys.disk.disk_octets"));
+        assertTrue(debug, debug.contains("date: 2019-04-11T05:59:42.848"));
+        assertTrue(debug, debug.contains("millis: 1554962382848"));
    }
 }
Author	SHA1	Message	Date
Bill Oley	c4ee035584	Release version 1.3.5	2022-01-07 14:40:06 -05:00
Chromico Rek	d4bfc1a3aa	Update log4j to 2.17.1 to address CVE-2021-44832 (#227 )	2021-12-30 13:50:34 -05:00
Chromico Rek	fb315148a1	Update log4j to 2.17 to address CVE-2021-45105. (#226 )	2021-12-20 10:44:47 -05:00
dependabot[bot]	e8ae575086	Bump @grafana/data from 8.2.2 to 8.2.3 in /grafana/timely-app (#222 ) Bumps [@grafana/data](https://github.com/grafana/grafana/tree/HEAD/packages/grafana-data) from 8.2.2 to 8.2.3. - [Release notes](https://github.com/grafana/grafana/releases) - [Changelog](https://github.com/grafana/grafana/blob/main/CHANGELOG.md) - [Commits](https://github.com/grafana/grafana/commits/v8.2.3/packages/grafana-data) --- updated-dependencies: - dependency-name: "@grafana/data" dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2021-12-15 16:59:06 -05:00
Christopher Tubbs	da0146c741	Bump log4j and other cleanup * Update log4j2 to 2.16.0 to address CVEs * Update impsort and sortpom plugins * Update spotbugs plugin to build on newer JDKs and suppress common minor warnings from that * Fix a few minor warnings from spotbugs that are easy: remove hamcrest matcher, fix null checks that are always or never null * Suppress module-info.class from shaded jars	2021-12-15 16:53:24 -05:00
Bill Oley	882b4e2587	Bump version to 1.3.5-SNAPSHOT	2021-11-01 10:17:49 -04:00