Release Notes for Apache Storm 3.1.0

Issues addressed in 3.1.0.

bug

• [#9082] - STORM-3871: sweep dependency blobs that outlive their topology's cleanup
• [#9076] - Drop malformed tuple payloads instead of killing the receiving worker
• [#9075] - Harden the java serialization fallback bridge with a JEP-290 serial filter
• [#9069] - Apply one redaction rule to configuration served and logged by Storm
• [#9014] - Test the OCI launch-command username and mount-source enforcement
• [#9013] - Return independently owned value arrays from get_values
• [#9012] - Reject a topology submission that lists a blob key which is not a dependency blob key
• [#9011] - STORM-3871: remove a topology's dependency artifact blobs when it is cleaned up
• [#9010] - Restrict OCI bind-mount sources to configured directories and check the launch command username
• [#9009] - Validate the worker id in profile-docker-container
• [#9008] - Validate the container id and invoke runc without a shell in reap-oci-container
• [#9007] - Read and check the docker command file before changing worker directory ownership
• [#9006] - Apply worker file ownership and mode via an open descriptor
• [#9005] - Evaluate authorization for requests that carry no principal
• [#9004] - Require every UI API endpoint to declare its authorization
• [#9003] - Filter the topology history by the authenticated caller rather than the requested user name
• [#9002] - Authorize createStateInZookeeper requests like the other blob operations
• [#9001] - Check the calling principal against the topology owner in uploadNewCredentials
• [#9000] - Apply the nimbus ACLs to listBlobs so callers only see blobs they may read
• [#8999] - Validate topology.blobstore.map in rebalance conf overrides against the calling user
• [#8998] - Evaluate nimbus.groups when nimbus.users is empty
• [#8993] - Decode netty server frames only after the handshake completes
• [#8992] - Update StormSubmitter logging behavior
• [#8991] - Return a normalized copy of the topology conf from Nimbus
• [#8990] - Require Kryo class registration in the state serializer
• [#8989] - Generate tuple tree ids from a key stream instead of a recoverable linear congruential generator
• [#8988] - Pass only the required Kafka consumer properties to the spout lag monitor
• [#8987] - Verify the peer identity of the Netty TLS server the worker client connects to
• [#8986] - Restrict topology scheduler strategies to the shipped strategies when no allowlist is configured
• [#8985] - Remove DRPC per-function request queues once they are empty
• [#8983] - Reject image tags that are neither mapped nor valid image hashes before building the manifest path
• [#8982] - Give each uploaded dependency artifact its own blob key instead of reusing a pre-existing blob
• [#8981] - Reject blobstore map local names that resolve outside the topology and worker directories
• [#8980] - Reject submitted jar locations that are not inside the Nimbus inbox
• [#8979] - Add to instead of replace Jetty's default TLS exclusions on HTTPS connectors
• [#8978] - Change the worker log file permission only for download requests that are served
• [#8976] - Set the CORS filter credentials parameter explicitly instead of a header name the filter ignores
• [#8975] - Stop echoing the request Origin with allow-credentials in logviewer JSON responses
• [#8974] - Return only the log files the requesting user may access from the log file listing
• [#8973] - Apply the configured log user and group lists to daemon log requests
• [#8972] - BugFix Utils.java
• [#7653] - [STORM-3871] Storm blobstore leak space

dependencies

• [#9080] - build(deps-dev): bump svgo from 4.0.2 to 4.1.0 in /storm-webapp
• [#9072] - build(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /storm-webapp
• [#9071] - build(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /storm-webapp
• [#9070] - build(deps): bump postcss-selector-parser from 7.1.1 to 7.1.5 in /storm-webapp
• [#9067] - build(deps): batch open Dependabot version updates
• [#9066] - build(deps-dev): bump start-server-and-test from 3.0.11 to 3.0.12 in /storm-webapp
• [#9065] - build(deps-dev): bump css-loader from 7.1.4 to 7.1.5 in /storm-webapp
• [#9064] - build(deps-dev): bump webpack-cli from 7.2.2 to 7.2.3 in /storm-webapp
• [#9063] - build(deps): bump cytoscape from 3.34.0 to 3.34.2 in /storm-webapp
• [#9062] - build(deps-dev): bump webpack from 5.109.2 to 5.110.1 in /storm-webapp
• [#9061] - build(deps): bump vis-data from 8.0.4 to 8.0.5 in /storm-webapp
• [#9060] - build(deps): bump datatables.net from 3.0.0 to 3.0.2 in /storm-webapp
• [#9059] - build(deps): bump js-yaml from 5.2.2 to 5.4.1 in /storm-webapp
• [#9058] - build(deps): bump cytoscape-dagre from 4.0.0 to 4.0.1 in /storm-webapp
• [#9057] - build(deps): bump datatables.net-bs5 from 3.0.0 to 3.0.2 in /storm-webapp
• [#9056] - build(deps): bump vis-network from 10.1.0 to 10.1.2 in /storm-webapp
• [#9055] - build(deps): bump datatables.net-dt from 3.0.0 to 3.0.2 in /storm-webapp
• [#9054] - build(deps-dev): bump cypress from 15.19.0 to 15.21.1 in /storm-webapp
• [#9053] - build(deps): bump org.apache.xbean:xbean-spring from 4.31 to 5.0.0 in /examples
• [#9052] - build(deps): bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre in /examples
• [#9051] - build(deps): bump org.junit:junit-bom from 6.1.2 to 6.1.3 in /examples
• [#9050] - build(deps): bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 in /examples
• [#9049] - build(deps): bump org.objenesis:objenesis from 3.5 to 3.6 in /examples
• [#9048] - build(deps): bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-15 in /examples
• [#9047] - build(deps): bump io.netty:netty-bom from 4.2.16.Final to 4.2.17.Final in /examples
• [#9046] - build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 in /examples
• [#9045] - build(deps): bump activemq.version from 6.3.0 to 6.3.1 in /examples
• [#9044] - build(deps): bump org.apache.avro:avro from 1.12.1 to 1.12.2 in /examples
• [#9043] - build(deps): bump spring.version from 7.0.8 to 7.0.9 in /examples
• [#9042] - build(deps): bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0 in /examples
• [#9041] - build(deps): bump byte-buddy.version from 1.18.11 to 1.18.12 in /examples
• [#9040] - build(deps): bump metrics.version from 4.2.39 to 4.2.40 in /examples
• [#9039] - build(deps): bump com.puppycrawl.tools:checkstyle from 13.9.0 to 14.0.0 in /examples
• [#9038] - build(deps): bump org.apache.xbean:xbean-spring from 4.31 to 5.0.0
• [#9037] - build(deps): bump org.jctools:jctools-core from 4.0.6 to 4.0.7 in /examples
• [#9036] - build(deps): bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre
• [#9035] - build(deps): bump jetty.version from 12.1.11 to 12.1.12 in /examples
• [#9034] - build(deps): bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-15
• [#9033] - build(deps): bump redis.clients:jedis from 7.5.3 to 8.0.1
• [#9032] - build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2
• [#9031] - build(deps): bump org.junit:junit-bom from 6.1.2 to 6.1.3
• [#9030] - build(deps): bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0
• [#9029] - build(deps): bump spring.version from 7.0.8 to 7.0.9
• [#9028] - build(deps): bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2
• [#9027] - build(deps): bump netty-tcnative.version from 2.0.81.Final to 2.0.82.Final
• [#9026] - build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2
• [#9025] - build(deps): bump org.objenesis:objenesis from 3.5 to 3.6
• [#9024] - build(deps): bump activemq.version from 6.3.0 to 6.3.1
• [#9023] - build(deps): bump org.jctools:jctools-core from 4.0.6 to 4.0.7
• [#9022] - build(deps): bump io.netty:netty-bom from 4.2.16.Final to 4.2.17.Final
• [#9021] - build(deps): bump metrics.version from 4.2.39 to 4.2.40
• [#9020] - build(deps): bump org.apache.avro:avro from 1.12.1 to 1.12.2
• [#9019] - build(deps): bump jetty.version from 12.1.11 to 12.1.12
• [#9018] - build(deps): bump byte-buddy.version from 1.18.11 to 1.18.12
• [#8970] - build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /storm-webapp
• [#8965] - build(deps): bump datatables.net-dt from 2.3.8 to 3.0.0 in /storm-webapp
• [#8964] - build(deps): bump datatables.net-bs5 from 2.3.8 to 3.0.0 in /storm-webapp
• [#8963] - build(deps): bump datatables.net from 2.3.8 to 3.0.0 in /storm-webapp
• [#8962] - build(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /storm-webapp
• [#8961] - build(deps-dev): bump webpack-cli from 7.2.1 to 7.2.2 in /storm-webapp
• [#8960] - build(deps): bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 in /examples
• [#8959] - build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 in /examples
• [#8958] - build(deps): bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 in /examples
• [#8957] - build(deps): bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12
• [#8956] - build(deps): bump activemq.version from 6.2.7 to 6.3.0 in /examples
• [#8955] - build(deps): bump activemq.version from 6.2.7 to 6.3.0
• [#8954] - build(deps-dev): bump com.github.eirslett:frontend-maven-plugin from 2.0.1 to 2.0.2
• [#8953] - build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1
• [#8952] - build(deps): bump postcss from 8.5.10 to 8.5.24 in /storm-webapp
• [#8951] - build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /storm-webapp
• [#8945] - build(deps-dev): bump svgo from 4.0.1 to 4.0.2 in /storm-webapp
• [#8944] - build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /storm-webapp
• [#8943] - build(deps): bump org.apache.xbean:xbean-spring from 4.30 to 4.31
• [#8942] - build(deps): bump org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1
• [#8941] - build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.1
• [#8940] - build(deps): bump bouncycastle.version from 1.84 to 1.85
• [#8939] - build(deps): bump org.apache.thrift:libthrift from 0.23.0 to 0.24.0
• [#8938] - build(deps): bump org.junit:junit-bom from 6.1.1 to 6.1.2
• [#8937] - build(deps): bump redis.clients:jedis from 7.5.2 to 7.5.3
• [#8936] - build(deps): bump byte-buddy.version from 1.18.10 to 1.18.11
• [#8935] - build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.1 in /examples
• [#8934] - build(deps): bump netty-tcnative.version from 2.0.80.Final to 2.0.81.Final
• [#8933] - build(deps): bump io.netty:netty-bom from 4.2.15.Final to 4.2.16.Final
• [#8932] - build(deps): bump byte-buddy.version from 1.18.10 to 1.18.11 in /examples
• [#8931] - build(deps): bump org.apache.thrift:libthrift from 0.23.0 to 0.24.0 in /examples
• [#8930] - build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1
• [#8929] - build(deps): bump org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1 in /examples
• [#8928] - build(deps): bump jakarta-activation-version from 1.2.1 to 2.0.1
• [#8927] - build(deps): bump io.netty:netty-bom from 4.2.15.Final to 4.2.16.Final in /examples
• [#8926] - build(deps): bump jakarta.ws.rs:jakarta.ws.rs-api from 3.1.0 to 4.0.0
• [#8925] - build(deps): bump org.apache.xbean:xbean-spring from 4.30 to 4.31 in /examples
• [#8924] - build(deps): bump com.puppycrawl.tools:checkstyle from 13.7.0 to 13.8.0 in /examples
• [#8923] - build(deps-dev): bump webpack from 5.108.3 to 5.108.4 in /storm-webapp
• [#8922] - build(deps): bump jetty.version from 12.1.10 to 12.1.11 in /examples
• [#8921] - build(deps-dev): bump cypress from 15.18.0 to 15.19.0 in /storm-webapp
• [#8920] - build(deps): bump jetty.version from 12.1.10 to 12.1.11
• [#8919] - build(deps-dev): bump webpack-cli from 7.1.0 to 7.2.1 in /storm-webapp
• [#8918] - build(deps): bump org.junit:junit-bom from 6.1.1 to 6.1.2 in /examples
• [#8917] - build(deps): bump bouncycastle.version from 1.84 to 1.85 in /examples
• [#8910] - build(deps): bump js-yaml from 5.2.0 to 5.2.1 in /storm-webapp
• [#8909] - build(deps-dev): bump axios from 1.16.1 to 1.18.1 in /storm-webapp

documentation

• [#8995] - Document that an unset scheduler strategy whitelist no longer allows every strategy class
• [#8984] - Clarify worker/supervisor heartbeat docs and deprecate unused nimbus.supervisor.timeout.secs
• [#8949] - docs: add missing 3.0.0 feature documentation

enhancement

• [#8977] - Add ui.enable.jsonp to control JSONP callback wrapping in UI and Logviewer API responses
• [#8969] - Sync checkstyle config with upstream google_checks.xml
• [#8950] - Add storm-iceberg module: an Apache Iceberg sink bolt
• [#7569] - [STORM-3787] Add error messages in worker-launcher code where it is missing