[SPARK-41695][BUILD][3.3] Upgrade netty to 4.1.86.Final

[tobiasstadler]

What changes were proposed in this pull request?

Upgrade netty to 4.1.86.Final;

I cherry-picked

• 56086cb
• 6d3c1c1
• 7154fb9
• ad81ba8
• c95ed82
• c26d99e
• 24adac3
• ff68d0e

Why are the changes needed?

CVEs

Does this PR introduce any user-facing change?

No

How was this patch tested?

CI

[bjornjorgensen]

Change [SPARK-41695][BUILD] Upgrade netty to 4.1.86.Final to [SPARK-41695][BUILD][3.3] Upgrade netty to 4.1.86.Final

[AmplabJenkins]

Can one of the admins verify this patch?

[dongjoon-hyun]

Does this affect Apache Spark technically, @tobiasstadler ?

[bjornjorgensen]

56086cb

Does this PR introduce any user-facing change?

Yes, all changes are caused by the change of Netty.
If the user wants to maintain the same behavior as the previous version, the user needs to make the following configuration:

• add -Dio.netty.allocator.useCacheForAllThreads=true to enable useCacheForAllThreads
• add -Dio.netty.allocator.maxOrder=11 to keep the chunk size of PooledByteBufAllocator to 16m

[bjornjorgensen]

And this one #38981

[tobiasstadler]

Ok, I didn‘t read that. I guess it is better to close the PR.

[bjornjorgensen]

@tobiasstadler
Hi, I have enabled SNYK and Github Dependabot on my repo.
This way SNYK are opening PR's and Dependabot are opening issues.

Right now, most of these PR's are related to Hadoop 2.7 which we will remove in spark 3.5 or 3.6.

I also build spark master and scan code with sonar

This one is for python and javascript

and this is for java, scala and xml

CC @panbingkun and @LuciferYang

[bjornjorgensen]

Hmm.. you can't see the Dependabot page

[LuciferYang]

@tobiasstadler Hi, I have enabled SNYK and Github Dependabot on my repo. This way SNYK are opening PR's and Dependabot are opening issues.

Right now, most of these PR's are related to Hadoop 2.7 which we will remove in spark 3.5 or 3.6.

I also build spark master and scan code with sonar

This one is for python and javascript

and this is for java, scala and xml

CC @panbingkun and @LuciferYang

Is the problem detected by sonar worth fixing @bjornjorgensen ?

[bjornjorgensen]

My intentions are to explain to a new contributor how I do it and what tools I use. Sonar is built on best practice rules, the problem is that not everything hits equally well. Here are the ones that I have found using Sonar that have entered the code base.

#36465
#36383
#36364
#35775
#35755
#35741