[BEAM-14118] beam-vendor-grpc-1_43_2 shades vulnerable Netty version

• Type: Improvement
• Status: Open
• Priority: P2
• Resolution: Unresolved
• Affects Version/s: 2.37.0
• Component/s: runner-flink, runner-spark, sdk-java-harness
• Labels: stale-P2
• Assignee: Unassigned
• Reporter: Arkadiusz Gasinski
• Created: 16/Mar/22 22:05
• Updated: 05/Jun/22 01:06

Description

The beam-vendor-grpc-1_43_2 dependency (that is pulled transitively by the beam-runners-flink-1.13) shades a vulnerable Netty version, i.e. 4.1.63.Final: https://mvnrepository.com/artifact/io.netty/netty-all/4.1.63.Final

In turn, our Beam pipelines builds are marked as vulnerable and we're having issues promoting them to higher environments. 

Because Netty is shaded, we can't simply override the version in the build tool.

Issue Links

• links to: GitHub Pull Request #17206