[new] Upgrade aircompressor to v3 (needs Java 22+) - #189
christophe-riolo wants to merge 4 commits into
Conversation
1. Adds support for private (e.g. ^:unsynchronized-mutable) fields 2. Adds caching for improved performance
Closes taoensso#188 Upgrades aircompressor from version 2.0.2 to 3.5. The jar has been compiled with Java 22 so that raises the minimum Java version
| (def ^:private ^ThreadLocal tl:gcm-cipher (enc/threadlocal (javax.crypto.Cipher/getInstance "AES/GCM/NoPadding"))) | ||
| (def ^:private ^ThreadLocal tl:cbc-cipher (enc/threadlocal (javax.crypto.Cipher/getInstance "AES/CBC/PKCS5Padding"))) |
There was a problem hiding this comment.
Unrelated, but there was a reflection warning
| "-Dtaoensso.elide-deprecated=true" | ||
| "-Dtaoensso.nippy.thaw-serializable-allowlist-base=base.1, base.2" | ||
| "-Dtaoensso.nippy.thaw-serializable-allowlist-add=add.1 , add.2" | ||
| "--enable-native-access=ALL-UNNAMED" |
There was a problem hiding this comment.
I am not fan of specifying this, IMO it should be handled better on aircompressor side. One option would be to always use the java versions of the compressors and decompressors, but I think it would be a shame to give up on the native versions
|
Also, the Faraday dependencies should be updated to use the new nippy release, because it's currently using a pretty old nippy version which depends on |
Then we probably should restrict the update to |
Nippy uses the aircompressor[1] compression lib under-the-hood. This library recently published security advisory GHSA-vx9q-rhv9-3jvg[2]. Based on the advisory description it seems that Nippy users should NOT be vulnerable since Nippy always creates a fresh output buffer when decompressing. Still, having the advisory associated with Nippy can be bothersome since it can generate noise from automated security tools, etc. This commit updates the aircompressor lib to avoid the vulnerability and so any related warnings. Note that PR #189 also exists to update to a newer (v3) version of the same lib, but avoiding this for now since bumping to v3 looks like it'd also increase the minimum Java version to v22. Thanks to @imrekoszo, @jumarko, @christophe-riolo for their assistance and input on this issue 🙏 [1] https://github.com/airlift/aircompressor [2] GHSA-vx9q-rhv9-3jvg
|
@christophe-riolo Thanks for this Christophe! 🙏 Apologies for the delay replying. This'll definitely be nice to have, but I agree with David that a bump to Java 22 is not ideal. I've just pushed https://github.com/taoensso/nippy/releases/tag/v3.6.2 which bumps to aircompressor v2.0.3. Let's keep this PR around for a potential future / breaking Nippy release 👍 Relatedly might also want to rethink possibilities for a more modular/pluggable way of controlling compression and/or encryption. |
|
I would suggest that you run 2 branches and offer 2 artefacts, this is similar to aircompressor itself who is still upgrading version 2 even though version 3 is there. I wouldn't do it like they do with major version number change, but I'd rather see the difference in the name of the artefact itself and then matching version numbers. |
1bc9866 to
e735f83
Compare
If I might interject here, I agree 100%, I am using nippy in a Data processing framework I am currently developing, and I keep getting that warning in the startup process. Since I am using java 25, I don't really care about the java 22+ requirement, so I would love to have this as a secondary artifact if possible. |
15461bd to
fe4045a
Compare
da5e75f to
97f0252
Compare
Closes #188
Upgrades aircompressor from version 2.0.2 to 3.5.
The jar has been compiled with Java 22 so that raises the minimum Java version