Conversation
<!--ci-cve-scan:must-fix: GHSA-84h7-rjj3-6jx4-->
📦 Build Failed: Missing Dependency
Build Details
Root Cause Analysis 🔍The build is failing because the Netty HTTP codec package is not available in the classpath. While netty-handler-4.1.125.Final.jar was downloaded from Chainguard, the specific io.netty.handler.codec.http package that TezBodyDeferringAsyncHandler is trying to import is missing. This suggests either an incomplete Netty dependency or a version mismatch where the required HTTP codec classes are not included in the available Netty artifacts. 🔍 Build failure fix suggestionsFound similar build failures that have been fixed in the past and analyzed them to suggest a fix: Similar PRs with fixesSuggested ChangesFile: tez/pombump-properties.yaml
Content: File: tez/pombump-deps.yaml
Content: Click to expand fix analysisAnalysisLooking at the similar fixes, there's a clear pattern: all three cases involved Netty dependency issues that were resolved by updating the Netty version in properties files. In Fix Examples #0 and #1, the netty4.version was updated from 4.1.118.Final to 4.1.127.Final in hadoop-project-pombump-properties.yaml, and some specific Netty codec dependencies were removed from pombump-deps.yaml. In Fix Example #2, the netty.version was updated from 4.1.124.Final to 4.1.125.Final in pombump-properties.yaml. The common solution is updating Netty to a newer version that contains the required HTTP codec classes. Click to expand fix explanationExplanationThe build is failing because the io.netty.handler.codec.http package is not available, even though netty-handler-4.1.125.Final.jar was downloaded. This indicates a version compatibility issue where the current Netty version doesn't include the required HTTP codec classes or they're in a separate artifact. Based on the similar fixes, updating to Netty 4.1.127.Final should resolve this issue because: 1) This version has been proven to work in similar Hadoop-related projects with the same error, 2) The HTTP codec classes are properly included in this version, 3) The pombump mechanism will ensure all Netty dependencies are consistently updated to this version across the project. The netty-codec-http artifact specifically contains the io.netty.handler.codec.http package that TezBodyDeferringAsyncHandler is trying to import. Click to expand alternative approachesAlternative Approaches
Was this comment helpful? Please use 👍 or 👎 reactions on this comment. |
Signed-off-by: Debasish Biswas <[email protected]>
|
Advisory merged |
tez/0.10.5-r7: fix GHSA-84h7-rjj3-6jx4
Advisory data: https://github.com/wolfi-dev/advisories/blob/main/tez.advisories.yaml
"Breadcrumbs" for this automated service
Inspected git repositories: https://github.com/apache/tez@rel/release-0.10.5