What's Changed
🚀 New Features
- Add ui.enable.jsonp to control JSONP callback wrapping in UI and Logviewer API responses by @rzo1 in #8977
- Add storm-iceberg module: an Apache Iceberg sink bolt by @GGraziadei in #8950
- Sync checkstyle config with upstream google_checks.xml by @sercuzz8 in #8969
🐛 Bug Fixes
- Return only the log files the requesting user may access from the log file listing by @rzo1 in #8974
- Change the worker log file permission only for download requests that are served by @rzo1 in #8978
- Reject image tags that are neither mapped nor valid image hashes before building the manifest path by @rzo1 in #8983
- Update StormSubmitter logging behavior by @GGraziadei in #8992
- Reject blobstore map local names that resolve outside the topology and worker directories by @rzo1 in #8981
- Stop echoing the request Origin with allow-credentials in logviewer JSON responses by @rzo1 in #8975
- Reject submitted jar locations that are not inside the Nimbus inbox by @rzo1 in #8980
- Verify the peer identity of the Netty TLS server the worker client connects to by @rzo1 in #8987
- Give each uploaded dependency artifact its own blob key instead of reusing a pre-existing blob by @rzo1 in #8982
- Require Kryo class registration in the state serializer by @GGraziadei in #8990
- Return a normalized copy of the topology conf from Nimbus by @GGraziadei in #8991
- Add to instead of replace Jetty's default TLS exclusions on HTTPS connectors by @rzo1 in #8979
- Pass only the required Kafka consumer properties to the spout lag monitor by @rzo1 in #8988
- Restrict topology scheduler strategies to the shipped strategies when no allowlist is configured by @rzo1 in #8986
- Decode netty server frames only after the handshake completes by @GGraziadei in #8993
- Set the CORS filter credentials parameter explicitly instead of a header name the filter ignores by @rzo1 in #8976
- BugFix Utils.java by @ZBaldi in #8972
- Apply the configured log user and group lists to daemon log requests by @rzo1 in #8973
- Generate tuple tree ids from a key stream instead of a recoverable linear congruential generator by @rzo1 in #8989
- Remove DRPC per-function request queues once they are empty by @rzo1 in #8985
- Validate topology.blobstore.map in rebalance conf overrides against the calling user by @rzo1 in #8999
- Evaluate nimbus.groups when nimbus.users is empty by @rzo1 in #8998
- Evaluate authorization for requests that carry no principal by @GGraziadei in #9005
- Apply the nimbus ACLs to listBlobs so callers only see blobs they may read by @rzo1 in #9000
- Read and check the docker command file before changing worker directory ownership by @reiabreu in #9007
- Authorize createStateInZookeeper requests like the other blob operations by @rzo1 in #9002
- Filter the topology history by the authenticated caller rather than the requested user name by @rzo1 in #9003
- Check the calling principal against the topology owner in uploadNewCredentials by @rzo1 in #9001
- STORM-3871: remove a topology's dependency artifact blobs when it is cleaned up by @rzo1 in #9011
- Reject a topology submission that lists a blob key which is not a dependency blob key by @rzo1 in #9012
- Validate the container id and invoke runc without a shell in reap-oci-container by @reiabreu in #9008
- Apply worker file ownership and mode via an open descriptor by @reiabreu in #9006
- Return independently owned value arrays from get_values by @reiabreu in #9013
- Restrict OCI bind-mount sources to configured directories and check the launch command username by @reiabreu in #9010
- Test the OCI launch-command username and mount-source enforcement by @reiabreu in #9014
- Require every UI API endpoint to declare its authorization by @GGraziadei in #9004
- Apply one redaction rule to configuration served and logged by Storm by @rzo1 in #9069
- Drop malformed tuple payloads instead of killing the receiving worker by @L1nq0 in #9076
- Harden the java serialization fallback bridge with a JEP-290 serial filter by @L1nq0 in #9075
- STORM-3871: sweep dependency blobs that outlive their topology's cleanup by @rzo1 in #9082
📦 Dependency Upgrades
- build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #8907
- build(deps-dev): bump axios from 1.16.1 to 1.18.1 in /storm-webapp by @dependabot[bot] in #8909
- build(deps): bump js-yaml from 5.2.0 to 5.2.1 in /storm-webapp by @dependabot[bot] in #8910
- build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #8911
- build(deps-dev): bump svgo from 4.0.1 to 4.0.2 in /storm-webapp by @dependabot[bot] in #8945
- build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /storm-webapp by @dependabot[bot] in #8944
- build(deps): bump org.apache.xbean:xbean-spring from 4.30 to 4.31 by @dependabot[bot] in #8943
- build(deps): bump org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1 by @dependabot[bot] in #8942
- build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.1 by @dependabot[bot] in #8941
- build(deps): bump bouncycastle.version from 1.84 to 1.85 by @dependabot[bot] in #8940
- build(deps): bump bouncycastle.version from 1.84 to 1.85 in /examples by @dependabot[bot] in #8917
- build(deps): bump org.apache.thrift:libthrift from 0.23.0 to 0.24.0 by @dependabot[bot] in #8939
- build(deps): bump jakarta-activation-version from 1.2.1 to 2.0.1 by @dependabot[bot] in #8928
- build(deps): bump com.puppycrawl.tools:checkstyle from 13.7.0 to 13.8.0 in /examples by @dependabot[bot] in #8924
- build(deps): bump org.apache.xbean:xbean-spring from 4.30 to 4.31 in /examples by @dependabot[bot] in #8925
- build(deps-dev): bump webpack-cli from 7.1.0 to 7.2.1 in /storm-webapp by @dependabot[bot] in #8919
- build(deps): bump jetty.version from 12.1.10 to 12.1.11 by @dependabot[bot] in #8920
- build(deps-dev): bump cypress from 15.18.0 to 15.19.0 in /storm-webapp by @dependabot[bot] in #8921
- build(deps): bump jetty.version from 12.1.10 to 12.1.11 in /examples by @dependabot[bot] in #8922
- build(deps): bump byte-buddy.version from 1.18.10 to 1.18.11 by @dependabot[bot] in #8936
- build(deps): bump org.junit:junit-bom from 6.1.1 to 6.1.2 in /examples by @dependabot[bot] in #8918
- build(deps): bump org.junit:junit-bom from 6.1.1 to 6.1.2 by @dependabot[bot] in #8938
- build(deps): bump redis.clients:jedis from 7.5.2 to 7.5.3 by @dependabot[bot] in #8937
- build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.1 in /examples by @dependabot[bot] in #8935
- build(deps): bump netty-tcnative.version from 2.0.80.Final to 2.0.81.Final by @dependabot[bot] in #8934
- build(deps): bump jakarta.ws.rs:jakarta.ws.rs-api from 3.1.0 to 4.0.0 by @dependabot[bot] in #8926
- build(deps): bump org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1 in /examples by @dependabot[bot] in #8929
- build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1 by @dependabot[bot] in #8930
- build(deps): bump byte-buddy.version from 1.18.10 to 1.18.11 in /examples by @dependabot[bot] in #8932
- build(deps-dev): bump webpack from 5.108.3 to 5.108.4 in /storm-webapp by @dependabot[bot] in #8923
- build(deps): bump io.netty:netty-bom from 4.2.15.Final to 4.2.16.Final in /examples by @dependabot[bot] in #8927
- build(deps): bump io.netty:netty-bom from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #8933
- build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /storm-webapp by @dependabot[bot] in #8951
- build(deps): bump postcss from 8.5.10 to 8.5.24 in /storm-webapp by @dependabot[bot] in #8952
- build(deps): bump datatables.net-dt from 2.3.8 to 3.0.0 in /storm-webapp by @dependabot[bot] in #8965
- build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @dependabot[bot] in #8953
- build(deps-dev): bump com.github.eirslett:frontend-maven-plugin from 2.0.1 to 2.0.2 by @dependabot[bot] in #8954
- build(deps-dev): bump webpack from 5.108.4 to 5.109.2 in /storm-webapp by @dependabot[bot] in #8962
- build(deps): bump activemq.version from 6.2.7 to 6.3.0 by @dependabot[bot] in #8955
- build(deps): bump activemq.version from 6.2.7 to 6.3.0 in /examples by @dependabot[bot] in #8956
- build(deps): bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #8957
- build(deps): bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 in /examples by @dependabot[bot] in #8958
- build(deps): bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 in /examples by @dependabot[bot] in #8960
- build(deps): bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #8967
- build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 in /examples by @dependabot[bot] in #8959
- build(deps): bump datatables.net from 2.3.8 to 3.0.0 in /storm-webapp by @dependabot[bot] in #8963
- build(deps-dev): bump webpack-cli from 7.2.1 to 7.2.2 in /storm-webapp by @dependabot[bot] in #8961
- build(deps): bump datatables.net-bs5 from 2.3.8 to 3.0.0 in /storm-webapp by @dependabot[bot] in #8964
- build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /storm-webapp by @dependabot[bot] in #8970
- build(deps): bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in #9015
- build(deps): batch open Dependabot version updates by @rzo1 in #9067
- build(deps): bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre by @dependabot[bot] in #9036
- build(deps): bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre in /examples by @dependabot[bot] in #9052
- build(deps): bump postcss-selector-parser from 7.1.1 to 7.1.5 in /storm-webapp by @dependabot[bot] in #9070
- build(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /storm-webapp by @dependabot[bot] in #9071
- build(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /storm-webapp by @dependabot[bot] in #9072
- build(deps-dev): bump svgo from 4.0.2 to 4.1.0 in /storm-webapp by @dependabot[bot] in #9080
📖 Documentation
- docs: add missing 3.0.0 feature documentation by @reiabreu in #8949
- Clarify worker/supervisor heartbeat docs and deprecate unused nimbus.supervisor.timeout.secs by @reiabreu in #8984
- Document that an unset scheduler strategy whitelist no longer allows every strategy class by @rzo1 in #8995
New Contributors
- @sercuzz8 made their first contribution in #8971
- @ZBaldi made their first contribution in #8972
- @L1nq0 made their first contribution in #9076
Full Changelog: v3.0.0...v3.1.0