- Update from 9.37.2 to 9.37.4 to address CVE
- 9.37.2 is vulnerable, 9.37.4 is the patched version for 9.x line
- Verified with mvn dependency:tree that override is applied
- Restore explicit Jetty version management in dependencyManagement
- Pin Jetty 12.0.12 for transitive dependencies from Spark/Hadoop
- Remove misleading comment about Jetty versions availability
- Include jetty-server, jetty-http, jetty-servlet, jetty-util, jetty-io, jetty-security
- Use jetty.version property for consistency across all Jetty artifacts
- Update Netty to 4.1.125.Final (latest security patch)
- Jetty 12.0.x versions greater than 12.0.9 do not exist in Maven Central
- Attempted 12.0.10, 12.0.12, 12.0.16 - none are available
- Next available versions are in 12.1.x series
- Remove Jetty dependency management to rely on transitive resolution
- Allows build to proceed with Jetty versions from Spark/Hadoop dependencies
- Can revisit with explicit version pinning if CVE concerns arise
- Add -dir=/data flag to volume server command
- Mount Docker volume seaweedfs-volume-data to /data
- Ensures volume server has persistent storage for volume files
- Fixes issue where volume server couldn't create writable volumes
- Volume data persists across container restarts during tests
- Upgrade from 9.4.53.v20231009 to 12.0.16 (meets requirement >12.0.9)
- Addresses security vulnerabilities in older Jetty versions
- Externalized version to jetty.version property for easier maintenance
- Added jetty-util, jetty-io, jetty-security to dependencyManagement
- Ensures all Jetty transitive dependencies use secure version
- Add -max=0 flag to volume server command
- Allows volume server to create unlimited 50MB volumes
- Fixes 'No writable volumes' error during Spark tests
- Volume server will create new volumes as needed for writes
- Consistent with other integration test configurations
- Upgrade from 3.9.3 to 3.9.4 (latest stable)
- Ensures all known security vulnerabilities are patched
- Fixes GHSA-g93m-8x6h-g5gv, GHSA-r978-9m6m-6gm6, GHSA-2hmj-97jw-28jh
- Upgrade from 3.9.1 to 3.9.3
- Fixes GHSA-g93m-8x6h-g5gv: Authentication bypass in Admin Server
- Fixes GHSA-r978-9m6m-6gm6: Information disclosure in persistent watchers
- Fixes GHSA-2hmj-97jw-28jh: Insufficient permission check in snapshot/restore
- Addresses high and moderate severity vulnerabilities
- Set Parquet I/O loggers to OFF (completely disabled)
- Add log4j.configuration system property to ensure config is used
- Override Spark's default log4j configuration
- Prevents thousands of record-level DEBUG messages in CI logs
- Add -Dcentral.publishing.skip=true to all Maven builds
- Central publishing plugin is only needed for Maven Central releases
- Prevents plugin resolution errors during CI builds
- Complements existing -Dgpg.skip=true flag
- Upgrade from 4.1.118.Final to 4.1.124.Final
- Fixes GHSA-prj3-ccx8-p6x4: MadeYouReset HTTP/2 DDoS vulnerability
- 4.1.124.Final is the confirmed patched version per GitHub advisory
- All versions <= 4.1.123.Final are vulnerable
- Upgrade from 4.1.115.Final to 4.1.118.Final
- Fixes CVE-2025-24970: improper validation in SslHandler
- Fixes CVE-2024-47535: unsafe environment file reading on Windows
- Fixes CVE-2024-29025: HttpPostRequestDecoder resource exhaustion
- Addresses GHSA-prj3-ccx8-p6x4 and related vulnerabilities
- Change volume -ip from seaweedfs-volume to 127.0.0.1
- Change -publicUrl from localhost:8080 to 127.0.0.1:8080
- Volume server now registers with master using 127.0.0.1
- Filer will return 127.0.0.1:8080 URL that's resolvable from host
- Fixes UnknownHostException for seaweedfs-volume hostname
- Set org.apache.parquet to WARN level
- Set org.apache.parquet.io to ERROR level
- Suppress RecordConsumerLoggingWrapper and MessageColumnIO DEBUG logs
- Reduces CI log noise from thousands of record-level messages
- Keeps important error messages visible
- Add -publicUrl=localhost:8080 to volume server command
- Ensures filer returns localhost URL instead of Docker service name
- Fixes UnknownHostException when tests run on host network
- Volume server is accessible via localhost from CI runner
- Add seaweedfs.hadoop3.client.version property set to 3.80
- Replace hardcoded version with ${seaweedfs.hadoop3.client.version}
- Enables easier version management from single location
- Follows Maven best practices for dependency versioning
- Add container status (docker compose ps -a) on startup failure
- Add detailed logs for all three services (master, volume, filer)
- Add container inspection to verify binary exists
- Add debugging info for spark-example job
- Helps diagnose startup failures before containers are torn down
- Add ls -la to show build-artifacts/docker/ contents
- Add file command to verify binary type
- Add --no-cache to docker compose build to prevent stale cache issues
- Ensures fresh build with current binary
- Remove '|| true' from COPY commands (not supported in Dockerfile)
- Remove optional weed_pub* and weed_sub* copies (not needed for tests)
- Simplify Dockerfile to only copy required files
- Keep chmod +x and ls -la verification for main binary
- Copy weed binary explicitly to /usr/bin/weed
- Run chmod +x immediately after COPY to ensure executable
- Add ls -la to verify binary exists and has correct permissions
- Make weed_pub* and weed_sub* copies optional with || true
- Simplify RUN commands for better layer caching
- Change compiler plugin source/target from hardcoded 1.8 to use properties
- Ensures consistency with maven.compiler.source/target set to 11
- Prevents version mismatch between properties and plugin configuration
- Aligns with surefire Java 9+ module arguments
- Extract common gRPC channel configuration to createChannelBuilder() method
- Reduce code duplication from 3 branches to single configuration
- Improve maintainability by centralizing channel settings
- Add Javadoc for the new helper method
- Add -volumeSizeLimitMB=50 to master (consistent with other integration tests)
- Add -defaultReplication=000 to master for explicit single-copy storage
- Add explicit -port and -port.grpc flags to all services
- Add -preStopSeconds=1 to volume for faster shutdown
- Add healthchecks to master and volume services
- Use service_healthy conditions for proper startup ordering
- Improve healthcheck intervals and timeouts for faster startup
- Use -ip flag instead of -ip.bind for service identity
- Ensures master runs in standalone single-node mode
- Prevents master from trying to form a cluster
- Required for proper initialization in test environment
- Download artifacts to 'build-artifacts' directory instead of '.'
- Prevents checkout from overwriting downloaded files
- Explicitly copy weed binary from build-artifacts to docker/ directory
- Update Maven artifact restoration to use new path
- Add step to chmod +x the weed binary after downloading artifacts
- Artifacts lose executable permissions during upload/download
- Prevents 'Permission denied' errors when Docker tries to run the binary
- Add step to restore Maven artifacts from download to ~/.m2/repository
- Restructure artifact upload to use consistent directory layout
- Remove obsolete 'version' field from docker-compose.yml to eliminate warnings
- Ensures SeaweedFS Java dependencies are available during test execution
1. Add explicit permissions (least privilege):
- contents: read
- checks: write (for test reports)
- pull-requests: write (for PR comments)
2. Extract duplicate build steps into shared 'build-deps' job:
- Eliminates duplication between spark-tests and spark-example
- Build artifacts are uploaded and reused by dependent jobs
- Reduces CI time and ensures consistency
3. Fix spark-example service startup verification:
- Match robust approach from spark-tests job
- Add explicit timeout and failure handling
- Verify all services (master, volume, filer)
- Include diagnostic logging on failure
- Prevents silent failures and obscure errors
These changes improve maintainability, security, and reliability
of the Spark integration test workflow.
- In testLargeDataset(), add orderBy("value") before calling first()
- Parquet files don't guarantee row order, so first() on unordered
DataFrame can return any row, making assertions flaky
- Sorting by 'value' ensures the first row is always the one with
value=0, making the test deterministic and reliable
- Fix inconsistency between maven.compiler.source/target (1.8) and
surefire JVM args (Java 9+ module flags like --add-opens)
- Update to Java 11 to match CI environment (GitHub Actions uses Java 11)
- Docker environment uses Java 17 which is also compatible
- Java 11+ is required for the --add-opens/--add-exports flags used
in the surefire configuration
- Add null check for HttpEntity in SeaweedWrite.multipartUpload()
to prevent NPE when response.getEntity() returns null
- Fix Makefile test target to properly export SEAWEEDFS_TEST_ENABLED
by setting it on the same command line as mvn test
- Update docker-compose commands to use V2 syntax (docker compose)
for consistency with GitHub Actions workflow
chrislu