Skip to content

Conversation

rohanshah18
Copy link
Contributor

@rohanshah18 rohanshah18 commented Mar 29, 2024

Problem

  1. The gRPC netty version 1.58.0 has vulnerability.
  2. I was still seeing some failing CI tests for data plane operations.

Solution

Updated the following dependencies version from 1.58.0 to 1.60.2.
"io.grpc:grpc-protobuf"
"io.grpc:grpc-stub"
"io.grpc:grpc-netty"

Compatibility matrix for grpc-netty and netty-tcnative-boringssl-static can be found here: https://github.com/grpc/grpc-java/blob/master/SECURITY.md#netty

Also as a part of this PR, I have reduced the delay that is set after upserting vectors in the integration tests to 90 seconds instead of 120 seconds and for updateAndQueryPodTest, I have followed the same pattern as serverless indexes to upsert once and run all of the tests after the upsertion.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • Infrastructure change (CI configs, etc)
  • Non-code change (docs, etc)
  • None of the above: (explain here)
    Dependencies were updated so it doesn't qualify for bug fix but instead security fix.

Test Plan

Ran integration tests on local a good couple of times and on the CI. Fixing configure index test is in flight and will be a future PR from @austin-denoble.

@rohanshah18 rohanshah18 marked this pull request as ready for review March 29, 2024 15:01
@rohanshah18 rohanshah18 requested review from austin-denoble, jhamon, aulorbe and ssmith-pc and removed request for austin-denoble March 29, 2024 15:01
@rohanshah18 rohanshah18 changed the title Update gRPC version to 1.60.2 to address vulnerability concerns Update gRPC version to 1.60.2 to address vulnerability concerns and fix data plane integration tests Mar 29, 2024
Copy link
Contributor

@austin-denoble austin-denoble left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for upgrading these dependency versions and reducing the wait time in these tests. 👍

@rohanshah18 rohanshah18 merged commit 640424f into main Mar 30, 2024
@rohanshah18 rohanshah18 deleted the rshah/updateGRPCVersion branch March 30, 2024 11:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants