Confidence in a 2.0.0 release?

[Michael Zamani]

I'm curious if you all have a rough idea of how close we are to being comfortable creating a 2.0.0 release, and if there's anything we can do at Apple to help build confidence, if there's a need for that?

I'm not sure if there's already discussion around this, or a rough timeline you all already have in mind, but if we can help by upgrading some of our apps and looking for issues (at least in our non-prod environments), I can maybe dedicate some resources to doing that.

[Nicholas Babcock]

I agree that I'd rather see a 2.0.0 release sooner rather than later. Sounds like others have completed migrations to 2.0rc and there have been no red flags.

joschen / artem, is there anything else that needs to be done?

[Jochen Schalanda]

Hi,

I'd love to address the 4 remaining issues/PRs in the 2.0.0 milestone (https://github.com/dropwizard/dropwizard/milestone/18) and change the documentation to ReadTheDocs (https://dropwizard.readthedocs.io/en/latest/) before a GA release.

For the issues in the 2.0.0 milestone, every help is appreciated. ;-)

Regarding the new documentation, we'll need some help from the fine folks of Rent the Runway who sponsor the domain dropwizard.io for us and would need to change the CNAME RR for that domain.

Cheers,

Jochen

[Michael Zamani]

Happy to help usher along https://github.com/dropwizard/dropwizard/pull/2795 and maybe I can find some time this weekend to take a crack at https://github.com/dropwizard/dropwizard/issues/2736 if nobody beats me to it.

Regarding the new documentation, we'll need some help from the fine folks of Rent the Runway who sponsor the domain dropwizard.io for us and would need to change the CNAME RR for that domain.

Do you guys have a means of reaching out to them?  

[Jochen Schalanda]

Hi everyone,

We're now down to only 1 open issue in the 2.0.0 milestone: "Update conscrypt documentation #2736"

https://github.com/dropwizard/dropwizard/milestone/18

Thanks for the help!

I would publish Dropwizard 2.0.0-rc3 as the (hopefully) last release candidate and if there are no regressions, we're ready to go.

Do you guys have a means of reaching out to them?  

Yes, we're already in contact with the responsible people at Rent the Runway. :-)

Cheers,

Jochen

--
You received this message because you are subscribed to the Google Groups "dropwizard-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dropwizard-de...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dropwizard-dev/e9ad011f-a9ba-4afb-8fb3-b76d5ffcf57d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Natan Abolafya]

Hi,

Running owasp dependency-check on dropwizard 2.0.0-rc3 reports this (among some liquibase ones for jquery and bootstrap but that has been around forever so we ignore it):

logback-throttling-appender-1.0.1.jar (pkg:maven/io.dropwizard.logback/logback-throt...@1.0.1, cpe:2.3:a:logback:logback:1.0.1:*:*:*:*:*:*:*) : CVE-2017-5929

Is that something to be worried about?

Natan

To unsubscribe from this group and stop receiving emails from it, send an email to dropwiz...@googlegroups.com.

[Jochen Schalanda]

Hi,

logback-throttling-appender-1.0.1.jar (pkg:maven/io.dropwizard.logback/logback-throt...@1.0.1, cpe:2.3:a:logback:logback:1.0.1:*:*:*:*:*:*:*) : CVE-2017-5929

Is that something to be worried about?

That's a false positive. That project only exists since 2019.

I think the OWASP dependency plugin at this point causes more problems than it solves, so maybe we'll remove it again. What does the rest of the developers think?

Cheers,

Jochen

[Matt Nelson]

I think it depends if it is OWASP causing problems or the NVD source. In this case the regex on the source is too open.

https://nvd.nist.gov/vuln/detail/CVE-2017-5929

Alternatively, with dropwizard using dependbot, even if a new CVE is reported, the project is likely already on the latest, so there is nothing to be done but wait for the upstream resolution.

[Nicholas Babcock]

The 2.0.0 milestone is reading 100% complete, so let's either look to wrap this up or assign more issues to the milestone :)

To unsubscribe from this group and stop receiving emails from it, send an email to dropwiz...@googlegroups.com.

[Stephen Souness]

I'd be keen to see a 2.0.0 release, as I see that the 1.3 branch has a release that addresses a CVE.

I have a small handful of services in production handling a fair volume of traffic on 2.0.0-rc4 and haven't encountered any upgrade related issues.

--

Stephen

[Michael Zamani]

+1. Also eager to see a 2.0.0 release. It's one of the dependencies preventing us from getting fully JDK 11 compatibility in some of our apps (due to the Hibernate and Jersey deps).

[Sadique Ali Koothumadan]

My team is also waiting for a 2.0.0 release so that we can migrate to JDK 11. Is there anything else holding up the release?

Thank you for all the work that went in to 2.0.0.

- Sadique Ali

[Stephen Souness]

Hi all.

I'm no longer actively working on projects involving Dropwizard, but am interested in seeing a 2.0.0 release.

Are there any technical blockers for this, or is it more a matter of appropriate people having the time?

--

Stephen

[Jochen Schalanda]

Hi Stephen,

right now we're waiting on the Jackson 2.10.0 release but we're blocked with this until the checksum issue with the artifacts has been resolved, see https://github.com/dropwizard/dropwizard/pull/2944 for details.

After that we're pretty much good go.

If you want to help bring Dropwizard 2.0.0 out the door, feel free to contribute to any issue in the 2.0.0 milestone: https://github.com/dropwizard/dropwizard/milestone/18 :-)

Best regards,

Jochen

To unsubscribe from this group and stop receiving emails from it, send an email to dropwizard-de...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dropwizard-dev/c7a8a3dc-0adb-4208-98c2-ff743d599a28%40googlegroups.com.

[Ryan Kennedy]

On Mon, Sep 30, 2019 at 1:14 PM Jochen Schalanda <joc...@schalanda.name> wrote:

right now we're waiting on the Jackson 2.10.0 release but we're blocked with this until the checksum issue with the artifacts has been resolved, see https://github.com/dropwizard/dropwizard/pull/2944 for details.

It looks like the underlying issue with Sonatype has been resolved:

https://issues.sonatype.org/browse/OSSRH-51881

Ryan