build(deps): bump github.com/twmb/franz-go from 1.5.2 to 1.5.3 #232

2022-05-23T17:31:44+03:00

dependabot[bot] commented

2022-05-23 17:31:44 +03:00

(Migrated from github.com)

Bumps github.com/twmb/franz-go from 1.5.2 to 1.5.3.

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.5.3

This bugfix release fixes a problem I noticed when reading Kafka source code last week. KIP-98 never specified what a sequence number wrapping meant when producing with idempotency enabled / with transactions, so I implemented this to wrap to negative. As it turns out, there is validation in the Kafka code that the sequence number must wrap to 0.

Thus, using this client, if an application produced 2**31 records to a single partition with idempotent production or with transactions without restarting, this client would enter a fatal state.

I'm not sure how common this use case is considering this bug has not been reported in 2 years, but this patch release is to ensure people do not encounter this bug after this point.

I've tested this by producing >2.147bil records to a single-partition Kafka topic before this patch, which eventually results in INVALID_RECORD errors, and then producing >2.2 records to a single-partition Kafka topic after this patch. The patch allows the client to produce indefinitely.

This release also includes a few commits that eliminate two external dependencies, and contains a patch in kadm to avoid a panic on nil input to a function.

4e2fa3f sticky: vendor go-rbtree, drop external dep

6c0756d drop go-cmp dep

27880b4 bugfix sink: sequence number wrapping for EOS

afc9017 kadm.CalculateGroupLag: avoid panic if input maps are nil

Commits

a7b3f80 CHANGELOG: note v1.5.3
289fe6f kgo: hide UniformStickyPartitioner for 1.5.3 release
b345422 sticky/rbtree.go: fixup a few lints
4e2fa3f sticky: vendor go-rbtree, drop external dep
6c0756d drop go-cmp dep
cdc3980 golangci-lint: do not run revive:redefines-builtin-id
27880b4 sink: bugfix sequence number wrapping for EOS
f57c050 kgo: add UniformBytesPartitioner (KIP-794)
997f257 examples: tidy-examples.sh
afc9017 kadm.CalculateGroupLag: avoid panic if input maps are nil
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/twmb/franz-go](https://github.com/twmb/franz-go) from 1.5.2 to 1.5.3. <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/twmb/franz-go/blob/master/CHANGELOG.md">github.com/twmb/franz-go's changelog</a>. <blockquote> <h1>v1.5.3</h1> This bugfix release fixes a problem I noticed when reading Kafka source code last week. KIP-98 never specified what a sequence number wrapping meant when producing with idempotency enabled / with transactions, so I implemented this to wrap to negative. As it turns out, there is validation in the Kafka code that the sequence number must wrap to 0. Thus, using this client, if an application produced <code>2**31</code> records to a single partition with idempotent production or with transactions without restarting, this client would enter a fatal state. I'm not sure how common this use case is considering this bug has not been reported in 2 years, but this patch release is to ensure people do not encounter this bug after this point. I've tested this by producing >2.147bil records to a single-partition Kafka topic before this patch, which eventually results in <code>INVALID_RECORD</code> errors, and then producing >2.2 records to a single-partition Kafka topic after this patch. The patch allows the client to produce indefinitely. This release also includes a few commits that eliminate two external dependencies, and contains a patch in kadm to avoid a panic on nil input to a function. <ul> <li><a href="https://github.com/twmb/franz-go/commit/4e2fa3f"><code>4e2fa3f</code></a> sticky: vendor go-rbtree, drop external dep</li> <li><a href="https://github.com/twmb/franz-go/commit/6c0756d"><code>6c0756d</code></a> drop go-cmp dep</li> <li><a href="https://github.com/twmb/franz-go/commit/27880b4"><code>27880b4</code></a> bugfix sink: sequence number wrapping for EOS</li> <li><a href="https://github.com/twmb/franz-go/commit/afc9017"><code>afc9017</code></a> kadm.CalculateGroupLag: avoid panic if input maps are nil</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/twmb/franz-go/commit/a7b3f80403c2dac5145a65b97051717bfea25704"><code>a7b3f80</code></a> CHANGELOG: note v1.5.3</li> <li><a href="https://github.com/twmb/franz-go/commit/289fe6f329e03dc5a3bc4f79874b1580b5c04e22"><code>289fe6f</code></a> kgo: hide UniformStickyPartitioner for 1.5.3 release</li> <li><a href="https://github.com/twmb/franz-go/commit/b345422788a0e013be817786dab27a99231acd73"><code>b345422</code></a> sticky/rbtree.go: fixup a few lints</li> <li><a href="https://github.com/twmb/franz-go/commit/4e2fa3fec23c0f30870a50c2fe3e9a5f43949fa5"><code>4e2fa3f</code></a> sticky: vendor go-rbtree, drop external dep</li> <li><a href="https://github.com/twmb/franz-go/commit/6c0756d70c5f1403b80654595ed5a07b4b69193c"><code>6c0756d</code></a> drop go-cmp dep</li> <li><a href="https://github.com/twmb/franz-go/commit/cdc39808686f5995da98a5d12140126db97444a6"><code>cdc3980</code></a> golangci-lint: do not run revive:redefines-builtin-id</li> <li><a href="https://github.com/twmb/franz-go/commit/27880b497e9471d527e7d33e1da9025d09bcb77a"><code>27880b4</code></a> sink: bugfix sequence number wrapping for EOS</li> <li><a href="https://github.com/twmb/franz-go/commit/f57c050039038b0397eb70390263b75eb609a775"><code>f57c050</code></a> kgo: add UniformBytesPartitioner (KIP-794)</li> <li><a href="https://github.com/twmb/franz-go/commit/997f2573d2ba0d828232573ec9e34983374de49c"><code>997f257</code></a> examples: tidy-examples.sh</li> <li><a href="https://github.com/twmb/franz-go/commit/afc9017ef3fab0384705a92aa4a2c06be03d7aad"><code>afc9017</code></a> kadm.CalculateGroupLag: avoid panic if input maps are nil</li> <li>See full diff in <a href="https://github.com/twmb/franz-go/compare/v1.5.2...v1.5.3">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/twmb/franz-go&package-manager=go_modules&previous-version=1.5.2&new-version=1.5.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

github-actions[bot] (Migrated from github.com) approved these changes 2022-05-23 17:32:00 +03:00

dependabot[bot] commented

2022-06-01 17:34:36 +03:00

(Migrated from github.com)

Superseded by #234.

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unistack-org/micro-tests#232