Upgrade multiple deps including bc-fips jars and transport-reactor-netty4

CHANGELOG.md

@@ -51,6 +51,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump Slf4j from 1.7.36 to 2.0.17 ([#19136](https://github.com/opensearch-project/OpenSearch/pull/19136))
 - Bump `org.apache.tika` from 2.9.2 to 3.2.2 ([#19125](https://github.com/opensearch-project/OpenSearch/pull/19125))
 - Bump `org.apache.commons:commons-compress` from 1.26.1 to 1.28.0 ([#19125](https://github.com/opensearch-project/OpenSearch/pull/19125))
+- Bump `io.projectreactor.netty:reactor_netty` from `1.2.5` to `1.2.9` ([#19222](https://github.com/opensearch-project/OpenSearch/pull/19222))
+- Bump `org.bouncycastle:bouncycastle_jce` from `2.0.0` to `2.1.1` ([#19222](https://github.com/opensearch-project/OpenSearch/pull/19222))
+- Bump `org.bouncycastle:bouncycastle_tls` from `2.0.20` to `2.1.20` ([#19222](https://github.com/opensearch-project/OpenSearch/pull/19222))
+- Bump `org.bouncycastle:bouncycastle_pkix` from `2.0.8` to `2.1.9` ([#19222](https://github.com/opensearch-project/OpenSearch/pull/19222))
+- Bump `org.bouncycastle:bouncycastle_pg` from `2.0.11` to `2.1.11` ([#19222](https://github.com/opensearch-project/OpenSearch/pull/19222))
+- Bump `org.bouncycastle:bouncycastle_util` from `2.0.3` to `2.1.4` ([#19222](https://github.com/opensearch-project/OpenSearch/pull/19222))
 - Bump `com.azure:azure-core` from 1.55.5 to 1.56.0 ([#19206](https://github.com/opensearch-project/OpenSearch/pull/19206))
 - Bump `com.google.cloud:google-cloud-core` from 2.59.0 to 2.60.0 ([#19208](https://github.com/opensearch-project/OpenSearch/pull/19208))
 - Bump `org.jsoup:jsoup` from 1.20.1 to 1.21.2 ([#19207](https://github.com/opensearch-project/OpenSearch/pull/19207))

client/rest/licenses/bc-fips-2.1.1.jar.sha1

@@ -0,0 +1 @@
+34c72d0367d41672883283933ebec24843570bf5

client/rest/licenses/bctls-fips-2.1.20.jar.sha1

@@ -0,0 +1 @@
+9c0632a6c5ca09a86434cf5e02e72c221e1c930f

client/rest/licenses/bcutil-fips-2.1.4.jar.sha1

@@ -0,0 +1 @@
+1d37b7a28560684f5b8e4fd65478c9130d4015d0

distribution/tools/plugin-cli/licenses/bc-fips-2.1.1.jar.sha1

@@ -0,0 +1 @@
+34c72d0367d41672883283933ebec24843570bf5

distribution/tools/plugin-cli/licenses/bcpg-fips-2.1.11.jar.sha1

@@ -0,0 +1 @@
+727e087a843f3a5a8143e4f3a7518c8c3517df18

gradle/libs.versions.toml

@@ -38,7 +38,7 @@ joda              = "2.12.7"
 roaringbitmap     = "1.3.0"
 
 # project reactor
-reactor_netty     = "1.2.5"
+reactor_netty     = "1.2.9"
 reactor           = "3.7.5"
 
 # client dependencies
@@ -61,11 +61,11 @@ hadoop3           = "3.3.6"
 # when updating this version, you need to ensure compatibility with:
 #  - plugins/ingest-attachment (transitive dependency, check the upstream POM)
 #  - distribution/tools/plugin-cli
-bouncycastle_jce  = "2.0.0"
-bouncycastle_tls  = "2.0.20"
-bouncycastle_pkix = "2.0.8"
-bouncycastle_pg   = "2.0.11"
-bouncycastle_util = "2.0.3"
+bouncycastle_jce  = "2.1.1"
+bouncycastle_tls  = "2.1.20"
+bouncycastle_pkix = "2.1.9"
+bouncycastle_pg   = "2.1.11"
+bouncycastle_util = "2.1.4"
 password4j        = "1.8.3"
 
 # test dependencies

libs/ssl-config/licenses/bc-fips-2.1.1.jar.sha1

@@ -0,0 +1 @@
+34c72d0367d41672883283933ebec24843570bf5

libs/ssl-config/licenses/bcpkix-fips-2.1.9.jar.sha1

@@ -0,0 +1 @@
+722eaefa83fd8c53e1fc019bde25e353258ed22b

libs/ssl-config/licenses/bctls-fips-2.1.20.jar.sha1

@@ -0,0 +1 @@
+9c0632a6c5ca09a86434cf5e02e72c221e1c930f

libs/ssl-config/licenses/bcutil-fips-2.1.4.jar.sha1

@@ -0,0 +1 @@
+1d37b7a28560684f5b8e4fd65478c9130d4015d0

libs/ssl-config/src/test/java/org/opensearch/common/ssl/PemKeyConfigTests.java

@@ -32,6 +32,9 @@
 
 package org.opensearch.common.ssl;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.OpenSearchTestCase;
 import org.hamcrest.Matchers;
 
@@ -55,6 +58,7 @@
 import static org.hamcrest.Matchers.iterableWithSize;
 import static org.hamcrest.Matchers.notNullValue;
 
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class PemKeyConfigTests extends OpenSearchTestCase {
     private static final int IP_NAME = 7;
     private static final int DNS_NAME = 2;

libs/ssl-config/src/test/java/org/opensearch/common/ssl/PemTrustConfigTests.java

@@ -32,6 +32,9 @@
 
 package org.opensearch.common.ssl;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.OpenSearchTestCase;
 import org.hamcrest.Matchers;
 
@@ -51,6 +54,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class PemTrustConfigTests extends OpenSearchTestCase {
 
     public void testBuildTrustConfigFromSinglePemFile() throws Exception {

libs/ssl-config/src/test/java/org/opensearch/common/ssl/PemUtilsTests.java

@@ -32,8 +32,11 @@
 
 package org.opensearch.common.ssl;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.OpenSearchTestCase;
 
 import java.io.IOException;
@@ -56,6 +59,7 @@
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.core.StringContains.containsString;
 
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class PemUtilsTests extends OpenSearchTestCase {
 
     private static final Supplier<char[]> EMPTY_PASSWORD = () -> new char[0];

libs/ssl-config/src/test/java/org/opensearch/common/ssl/SslConfigurationLoaderTests.java

@@ -32,9 +32,12 @@
 
 package org.opensearch.common.ssl;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
 import org.opensearch.common.settings.MockSecureSettings;
 import org.opensearch.common.settings.Settings;
 import org.opensearch.core.common.settings.SecureString;
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.OpenSearchTestCase;
 
 import javax.net.ssl.KeyManagerFactory;
@@ -51,6 +54,7 @@
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.notNullValue;
 
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class SslConfigurationLoaderTests extends OpenSearchTestCase {
 
     private final String STRONG_PRIVATE_SECRET = "6!6428DQXwPpi7@$ggeg/=";

libs/ssl-config/src/test/java/org/opensearch/common/ssl/SslDiagnosticsTests.java

@@ -32,7 +32,10 @@
 
 package org.opensearch.common.ssl;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
 import org.opensearch.common.Nullable;
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.OpenSearchTestCase;
 import org.hamcrest.Matchers;
 
@@ -59,6 +62,7 @@
 
 import org.mockito.Mockito;
 
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class SslDiagnosticsTests extends OpenSearchTestCase {
 
     // Some constants for use in mock certificates

modules/reindex/src/test/java/org/opensearch/index/reindex/ReindexRestClientSslTests.java

@@ -32,6 +32,8 @@
 
 package org.opensearch.index.reindex;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
 import com.sun.net.httpserver.HttpsConfigurator;
 import com.sun.net.httpserver.HttpsExchange;
 import com.sun.net.httpserver.HttpsParameters;
@@ -48,6 +50,7 @@
 import org.opensearch.core.common.bytes.BytesArray;
 import org.opensearch.env.Environment;
 import org.opensearch.env.TestEnvironment;
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.OpenSearchTestCase;
 import org.opensearch.watcher.ResourceWatcherService;
 import org.hamcrest.Matchers;
@@ -82,6 +85,7 @@
  * right SSL keys + trust settings.
  */
 @SuppressForbidden(reason = "use http server")
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class ReindexRestClientSslTests extends OpenSearchTestCase {
 
     private static final String STRONG_PRIVATE_SECRET = "6!6428DQXwPpi7@$ggeg/=";

plugins/repository-azure/licenses/reactor-netty-core-1.2.9.jar.sha1

@@ -0,0 +1 @@
+aa1979804ad9f8e3b59f60681bfd2400a16d7b9b

plugins/repository-azure/licenses/reactor-netty-http-1.2.9.jar.sha1

@@ -0,0 +1 @@
+aea5b2eb6f1cb9a933a4c97745291ffc34ec10d6

plugins/transport-reactor-netty4/licenses/reactor-netty-core-1.2.9.jar.sha1

@@ -0,0 +1 @@
+aa1979804ad9f8e3b59f60681bfd2400a16d7b9b

plugins/transport-reactor-netty4/licenses/reactor-netty-http-1.2.9.jar.sha1

@@ -0,0 +1 @@
+aea5b2eb6f1cb9a933a4c97745291ffc34ec10d6

plugins/transport-reactor-netty4/src/test/java/org/opensearch/http/reactor/netty4/ssl/SecureReactorNetty4HttpServerTransportTests.java

@@ -8,6 +8,8 @@
 
 package org.opensearch.http.reactor.netty4.ssl;
 
+import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
+
 import org.apache.logging.log4j.message.ParameterizedMessage;
 import org.opensearch.common.network.NetworkAddress;
 import org.opensearch.common.network.NetworkService;
@@ -35,6 +37,7 @@
 import org.opensearch.rest.RestChannel;
 import org.opensearch.rest.RestRequest;
 import org.opensearch.telemetry.tracing.noop.NoopTracer;
+import org.opensearch.test.BouncyCastleThreadFilter;
 import org.opensearch.test.KeyStoreUtils;
 import org.opensearch.test.OpenSearchTestCase;
 import org.opensearch.test.rest.FakeRestRequest;
@@ -97,6 +100,7 @@
 /**
  * Tests for the secure {@link ReactorNetty4HttpServerTransport} class.
  */
+@ThreadLeakFilters(filters = BouncyCastleThreadFilter.class)
 public class SecureReactorNetty4HttpServerTransportTests extends OpenSearchTestCase {
 
     private NetworkService networkService;

test/framework/licenses/bc-fips-2.1.1.jar.sha1

@@ -0,0 +1 @@
+34c72d0367d41672883283933ebec24843570bf5

test/framework/licenses/bcpkix-fips-2.1.9.jar.sha1

@@ -0,0 +1 @@
+722eaefa83fd8c53e1fc019bde25e353258ed22b

test/framework/licenses/bcutil-fips-2.1.4.jar.sha1

@@ -0,0 +1 @@
+1d37b7a28560684f5b8e4fd65478c9130d4015d0

test/framework/src/main/java/org/opensearch/test/BouncyCastleThreadFilter.java

@@ -0,0 +1,23 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.test;
+
+import com.carrotsearch.randomizedtesting.ThreadFilter;
+
+/**
+ * ThreadFilter to exclude ThreadLeak checks for BC’s global background threads
+ */
+public class BouncyCastleThreadFilter implements ThreadFilter {
+    @Override
+    public boolean reject(Thread t) {
+        String n = t.getName();
+        // Ignore BC’s global background threads
+        return "BC Disposal Daemon".equals(n) || "BC Cleanup Executor".equals(n);
+    }
+}