build(deps): bump github.com/twmb/franz-go from 1.3.1 to 1.3.2 #164

2022-02-10T19:10:16+03:00

dependabot[bot] commented

2022-02-10 19:10:16 +03:00

(Migrated from github.com)

Bumps github.com/twmb/franz-go from 1.3.1 to 1.3.2.

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.3.2

This patch fixes a bug of unclear severity related to transactions. Credit goes to @eduard-netsajev for finding this long standing problem.

In Kafka, if you try to start a transaction too soon after finishing the previous one, Kafka may not actually have internally finished the prior transaction yet and can return a CONCURRENT_TRANSACTIONS error. To work around this, clients are expected to retry when they see this error (even though it is marked as not retriable).

This client does that properly, but unfortunately did not bubble up any non CONCURRENT_TRANSACTIONS errors.

From the code, it appears as if in the worst case, this could have meant that transactions invisibly looked like they were working and being used when they actually were not. However, it's likely that other errors would be noticed internally, and it's possible that if you encountered problems, the entire ETL pipeline would stall anyway.

All told, it's not entirely clear what the ramifications for this bug are, and it is recommended that if you use transactions, you should update immediately.

[PR #131](twmb/franz-go#131) - txns: don't ignore error in doWithConcurrentTransactions

Commits

3a28402 CHANGELOG: note incoming v1.3.2
15347e6 Merge pull request #131 from eduard-netsajev/bugfix
8aa64eb txns: don't ignore error
0a23cca Merge pull request #124 from amboz/patch-1
0410e90 Update README.md
a16691e Update README.md
5eb0560 Merge pull request #123 from godwhoa/fix_readme_example
c4c3059 README: fix code example
91b3086 README: note KIP-800 support, drop trailing 0's from versions
82cd996 generate,kversion: add Reason support in {Join,Leave}Request
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/twmb/franz-go](https://github.com/twmb/franz-go) from 1.3.1 to 1.3.2. <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/twmb/franz-go/blob/master/CHANGELOG.md">github.com/twmb/franz-go's changelog</a>. <blockquote> <h1>v1.3.2</h1> This patch fixes a bug of unclear severity related to transactions. Credit goes to <a href="https://github.com/eduard-netsajev"><code>@eduard-netsajev</code></a> for finding this long standing problem. In Kafka, if you try to start a transaction too soon after finishing the previous one, Kafka may not actually have internally finished the prior transaction yet and can return a <code>CONCURRENT_TRANSACTIONS</code> error. To work around this, clients are expected to retry when they see this error (even though it is marked as not retriable). This client does that properly, but unfortunately did not bubble up any non <code>CONCURRENT_TRANSACTIONS</code> errors. From the code, it appears as if in the worst case, this could have meant that transactions invisibly looked like they were working and being used when they actually were not. However, it's likely that other errors would be noticed internally, and it's possible that if you encountered problems, the entire ETL pipeline would stall anyway. All told, it's not entirely clear what the ramifications for this bug are, and it is recommended that if you use transactions, you should update immediately. <ul> <li>[PR <a href="https://github-redirect.dependabot.com/twmb/franz-go/issues/131">#131</a>](<a href="https://github-redirect.dependabot.com/twmb/franz-go/pull/131">twmb/franz-go#131</a>) - txns: don't ignore error in doWithConcurrentTransactions</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/twmb/franz-go/commit/3a28402f8751d97783281cc6bc9f53941983e649"><code>3a28402</code></a> CHANGELOG: note incoming v1.3.2</li> <li><a href="https://github.com/twmb/franz-go/commit/15347e699be66f8870632c82a4809eb3138b23c4"><code>15347e6</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/twmb/franz-go/issues/131">#131</a> from eduard-netsajev/bugfix</li> <li><a href="https://github.com/twmb/franz-go/commit/8aa64eb19713f69fb6d5afef2da656fc390329c2"><code>8aa64eb</code></a> txns: don't ignore error</li> <li><a href="https://github.com/twmb/franz-go/commit/0a23cca3f4ee9d69b6cb2e70aab1c8e012b901ad"><code>0a23cca</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/twmb/franz-go/issues/124">#124</a> from amboz/patch-1</li> <li><a href="https://github.com/twmb/franz-go/commit/0410e90fc0fd782d3cd0a841a2bdd88256e9c07c"><code>0410e90</code></a> Update README.md</li> <li><a href="https://github.com/twmb/franz-go/commit/a16691eb81b9afd9c2f5fc8ef9393f8aaa1c9f4d"><code>a16691e</code></a> Update README.md</li> <li><a href="https://github.com/twmb/franz-go/commit/5eb0560552b069303870527676add69837e3c101"><code>5eb0560</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/twmb/franz-go/issues/123">#123</a> from godwhoa/fix_readme_example</li> <li><a href="https://github.com/twmb/franz-go/commit/c4c3059ae3deaf7a9aa09f863bf740e5dde15131"><code>c4c3059</code></a> README: fix code example</li> <li><a href="https://github.com/twmb/franz-go/commit/91b30863ac2f68dcdd63320ae62d38689fbae35e"><code>91b3086</code></a> README: note KIP-800 support, drop trailing 0's from versions</li> <li><a href="https://github.com/twmb/franz-go/commit/82cd996ead8195966c5d28f2f018ba6e86c7a29d"><code>82cd996</code></a> generate,kversion: add Reason support in {Join,Leave}Request</li> <li>See full diff in <a href="https://github.com/twmb/franz-go/compare/v1.3.1...v1.3.2">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/twmb/franz-go&package-manager=go_modules&previous-version=1.3.1&new-version=1.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

vtolstov (Migrated from github.com) approved these changes 2022-02-10 19:10:38 +03:00

dependabot[bot] commented

2022-02-16 17:17:37 +03:00

(Migrated from github.com)

Superseded by #167.

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unistack-org/micro-tests#164