[FLINK-36510] Upgrade Pekko from 1.0.1 to 1.1.2

• Type: Technical Debt
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.20.0, 1.19.1, 2.0-preview
• Fix Version/s: 2.0.0, 1.19.2, 1.20.1
• Component/s: Runtime / Coordination
• Labels: pull-request-available
• Assignee: Grace Grimwood
• Reporter: Grace Grimwood
• Created: 11/Oct/24 08:30
• Updated: 5 days ago 04:17
• Resolved: 22/Oct/24 16:59

Description

Updates Pekko dependency to 1.1.2 which in turn upgrades Netty 3 to 4 (addressing FLINK-29065 and removing several CVEs from Flink). Pekko 1.1 also upgrades other dependencies such as slf4j and Jackson. For more details see the Pekko 1.1 release notes.

Issue Links

• causes: FLINK-36979 Revert netty bump for 1.20 and 1.19
• fixes: FLINK-29065 Flink v1.15.1 contains netty(version:3.10.6). There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx
• relates to: FLINK-33505 switch away from using netty 3 based Pekko Classic Remoting
• relates to: FLINK-32683 Update Pekko from 1.0.0 to 1.0.1
• links to: GitHub Pull Request #25494
• links to: GitHub Pull Request #25550
• links to: GitHub Pull Request #25603