[GEODE-10614] Preparation of release 2.0.3

boms/geode-all-bom/src/test/resources/expected-pom.xml

@@ -195,7 +195,7 @@
       <dependency>
         <groupId>io.micrometer</groupId>
         <artifactId>micrometer-core</artifactId>
-        <version>1.15.12</version>
+        <version>1.16.7</version>
       </dependency>
       <dependency>
         <groupId>io.swagger.core.v3</groupId>
@@ -475,22 +475,22 @@
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-core</artifactId>
-        <version>2.21.5</version>
+        <version>2.21.6</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
-        <version>2.21.5</version>
+        <version>2.21.6</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.datatype</groupId>
         <artifactId>jackson-datatype-joda</artifactId>
-        <version>2.21.5</version>
+        <version>2.21.6</version>
       </dependency>
       <dependency>
         <groupId>com.fasterxml.jackson.datatype</groupId>
         <artifactId>jackson-datatype-jsr310</artifactId>
-        <version>2.21.5</version>
+        <version>2.21.6</version>
       </dependency>
       <dependency>
         <groupId>com.jayway.jsonpath</groupId>

build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy

@@ -48,16 +48,16 @@ class DependencyConstraints {
     deps.put("jgroups.version", "3.6.20.Final")
     deps.put("log4j.version", "2.25.5")
     deps.put("log4j-slf4j2-impl.version", "2.23.1")
-    deps.put("micrometer.version", "1.15.12")
+    deps.put("micrometer.version", "1.16.7")
     deps.put("shiro.version", "3.0.0")
     // GEODE-10583: Pin Bouncy Castle (transitive via shiro-crypto-hash) to a fixed version
     deps.put("bouncycastle.version", "1.85")
     deps.put("slf4j-api.version", "2.0.18")
     deps.put("jakarta.transaction-api.version", "2.0.1")
     deps.put("jboss-modules.version", "1.11.0.Final")
-    deps.put("jackson.version", "2.21.5")
+    deps.put("jackson.version", "2.21.6")
     deps.put("jackson.annotations.version", "2.21")
-    deps.put("jackson.databind.version", "2.21.5")
+    deps.put("jackson.databind.version", "2.21.6")
     // Spring Framework 6.x Migration
     deps.put("springshell.version", "3.3.3")
     deps.put("springframework.version", "6.1.21")
@@ -67,6 +67,9 @@ class DependencyConstraints {
     deps.put("springldap.version", "3.2.7")
     deps.put("springdoc.version", "2.6.0")
 
+    // Pin Reactor Core (transitive via spring-shell-core) to a fixed version
+    deps.put("reactor-core.version", "3.8.7")
+
     // These version numbers are used in testing various versions of tomcat and are consumed explicitly
     // in will be called explicitly in the relevant extensions module, and respective configurations
     // in geode-assembly.gradle.  Moreover, dependencyManagement does not seem to play nicely when
@@ -149,6 +152,8 @@ class DependencyConstraints {
         api(group: 'io.github.resilience4j', name: 'resilience4j-retry', version: '1.7.1')
         api(group: 'io.lettuce', name: 'lettuce-core', version: '6.1.8.RELEASE')
         api(group: 'io.micrometer', name: 'micrometer-core', version: get('micrometer.version'))
+        // Pin Reactor Core (pulled in via spring-shell-core) to 3.8.7
+        api(group: 'io.projectreactor', name: 'reactor-core', version: get('reactor-core.version'))
         api(group: 'io.swagger.core.v3', name: 'swagger-annotations', version: '2.2.22')
         api(group: 'org.hdrhistogram', name: 'HdrHistogram', version: '2.2.2')
         api(group: 'it.unimi.dsi', name: 'fastutil', version: get('fastutil.version'))
@@ -176,7 +181,7 @@ class DependencyConstraints {
         api(group: 'org.apache.commons', name: 'commons-text', version: 1.9)
         api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0')
         // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support
-        api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4')
+        api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.6.4')
         api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.4.3')
         api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.4.3')
         // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete)

geode-assembly/src/integrationTest/java/org/apache/geode/rest/internal/web/RestSecurityIntegrationTest.java

@@ -107,6 +107,8 @@ public void testPostQuery() {
     assertResponse(restClient.doPost("/queries?id=0&q=", "user", "user", ""))
         .hasStatusCode(403);
     assertResponse(restClient.doPost("/queries?id=0&q=", "dataRead", "dataRead", ""))
+        .hasStatusCode(403);
+    assertResponse(restClient.doPost("/queries?id=0&q=", "dataWrite", "dataWrite", ""))
         .hasStatusCode(500);
   }
 
@@ -127,6 +129,8 @@ public void testPutQuery() {
     assertResponse(restClient.doPut("/queries/id", "user", "user", "{\"id\" : \"foo\"}"))
         .hasStatusCode(403);
     assertResponse(restClient.doPut("/queries/id", "dataRead", "dataRead", "{\"id\" : \"foo\"}"))
+        .hasStatusCode(403);
+    assertResponse(restClient.doPut("/queries/id", "dataWrite", "dataWrite", "{\"id\" : \"foo\"}"))
         .hasStatusCode(404);
   }
 

geode-assembly/src/integrationTest/java/org/apache/geode/rest/internal/web/RestSecurityPostProcessorTest.java

@@ -158,7 +158,7 @@ public void namedQuery() throws Exception {
     // Install the named query
     assertResponse(
         restClient.doPost("/queries?id=selectCustomer&q=" + URLEncoder.encode(namedQuery, "UTF-8"),
-            "dataReader", "1234567", ""))
+            "dataUser", "1234567", ""))
                 .hasStatusCode(201);
 
     // Verify the query has been installed

geode-assembly/src/integrationTest/resources/assembly_content.txt

@@ -960,16 +960,16 @@ lib/geode-unsafe-0.0.0.jar
 lib/geode-wan-0.0.0.jar
 lib/gfsh-dependencies.jar
 lib/hibernate-validator-8.0.2.Final.jar
-lib/httpclient5-5.4.4.jar
+lib/httpclient5-5.6.4.jar
 lib/httpcore5-5.4.3.jar
 lib/httpcore5-h2-5.4.3.jar
 lib/istack-commons-runtime-4.1.1.jar
 lib/jackson-annotations-2.21.jar
-lib/jackson-core-2.21.5.jar
-lib/jackson-databind-2.21.5.jar
-lib/jackson-dataformat-yaml-2.21.5.jar
-lib/jackson-datatype-joda-2.21.5.jar
-lib/jackson-datatype-jsr310-2.21.5.jar
+lib/jackson-core-2.21.6.jar
+lib/jackson-databind-2.21.6.jar
+lib/jackson-dataformat-yaml-2.21.6.jar
+lib/jackson-datatype-joda-2.21.6.jar
+lib/jackson-datatype-jsr310-2.21.6.jar
 lib/jakarta.activation-api-2.1.3.jar
 lib/jakarta.annotation-api-2.1.1.jar
 lib/jakarta.el-api-5.0.0.jar
@@ -1013,6 +1013,7 @@ lib/jna-5.11.0.jar
 lib/jna-platform-5.11.0.jar
 lib/joda-time-2.12.7.jar
 lib/jopt-simple-5.0.4.jar
+lib/jspecify-1.0.1.jar
 lib/jul-to-slf4j-2.0.17.jar
 lib/log4j-api-2.25.5.jar
 lib/log4j-core-2.25.5.jar
@@ -1024,15 +1025,15 @@ lib/lucene-analysis-phonetic-9.12.3.jar
 lib/lucene-core-9.12.3.jar
 lib/lucene-queries-9.12.3.jar
 lib/lucene-queryparser-9.12.3.jar
-lib/micrometer-commons-1.15.12.jar
-lib/micrometer-core-1.15.12.jar
-lib/micrometer-observation-1.15.12.jar
+lib/micrometer-commons-1.16.7.jar
+lib/micrometer-core-1.16.7.jar
+lib/micrometer-observation-1.16.7.jar
 lib/mx4j-3.0.2.jar
 lib/mx4j-remote-3.0.2.jar
 lib/mx4j-tools-3.0.1.jar
 lib/ra.jar
 lib/reactive-streams-1.0.4.jar
-lib/reactor-core-3.6.10.jar
+lib/reactor-core-3.8.7.jar
 lib/rmiio-2.1.2.jar
 lib/shiro-cache-3.0.0.jar
 lib/shiro-config-core-3.0.0.jar

geode-assembly/src/integrationTest/resources/expected_jars.txt

@@ -79,6 +79,7 @@ joda-time
 jopt-simple
 json-path
 json-smart
+jspecify
 jul-to-slf4j
 lang-tag
 log4j-api

geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt

@@ -21,11 +21,11 @@ spring-shell-starter-3.3.3.jar
 spring-web-6.1.21.jar
 commons-lang3-3.18.0.jar
 rmiio-2.1.2.jar
-jackson-datatype-jsr310-2.21.5.jar
-jackson-datatype-joda-2.21.5.jar
-jackson-core-2.21.5.jar
-jackson-dataformat-yaml-2.21.5.jar
-jackson-databind-2.21.5.jar
+jackson-datatype-jsr310-2.21.6.jar
+jackson-datatype-joda-2.21.6.jar
+jackson-core-2.21.6.jar
+jackson-dataformat-yaml-2.21.6.jar
+jackson-databind-2.21.6.jar
 swagger-annotations-2.2.22.jar
 jaxb-runtime-4.0.2.jar
 jaxb-core-4.0.2.jar
@@ -60,7 +60,7 @@ lucene-analysis-common-9.12.3.jar
 lucene-queryparser-9.12.3.jar
 lucene-queries-9.12.3.jar
 lucene-core-9.12.3.jar
-httpclient5-5.4.4.jar
+httpclient5-5.6.4.jar
 httpcore5-h2-5.4.3.jar
 httpcore5-5.4.3.jar
 HikariCP-4.0.3.jar
@@ -76,7 +76,7 @@ commons-digester-2.1.jar
 commons-io-2.19.0.jar
 commons-logging-1.3.5.jar
 classgraph-4.8.147.jar
-micrometer-core-1.15.12.jar
+micrometer-core-1.16.7.jar
 HdrHistogram-2.2.2.jar
 fastutil-8.5.8.jar
 jakarta.resource-api-2.1.0.jar
@@ -124,12 +124,13 @@ jline-reader-3.26.3.jar
 jline-style-3.26.3.jar
 jline-terminal-3.26.3.jar
 jline-native-3.26.3.jar
-micrometer-observation-1.15.12.jar
+micrometer-observation-1.16.7.jar
 spring-jcl-6.1.21.jar
-micrometer-commons-1.15.12.jar
+micrometer-commons-1.16.7.jar
+jspecify-1.0.1.jar
 LatencyUtils-2.0.3.jar
 snakeyaml-2.5.jar
-reactor-core-3.6.10.jar
+reactor-core-3.8.7.jar
 ST4-4.3.3.jar
 txw2-4.0.2.jar
 asm-commons-9.10.1.jar

geode-core/src/integrationTest/java/org/apache/geode/cache/client/internal/RegisterInterestPolicyPartIntegrationTest.java

@@ -0,0 +1,162 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.geode.cache.client.internal;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.io.Serializable;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+
+import org.apache.geode.cache.DataPolicy;
+import org.apache.geode.cache.RegionShortcut;
+import org.apache.geode.cache.client.PoolFactory;
+import org.apache.geode.cache.client.PoolManager;
+import org.apache.geode.internal.cache.tier.InterestType;
+import org.apache.geode.internal.cache.tier.MessageType;
+import org.apache.geode.internal.cache.tier.sockets.ChunkedMessage;
+import org.apache.geode.internal.cache.tier.sockets.Message;
+import org.apache.geode.internal.serialization.KnownVersion;
+import org.apache.geode.test.junit.categories.ClientServerTest;
+import org.apache.geode.test.junit.rules.ServerStarterRule;
+
+/**
+ * Exercises, over a real client connection to a running server, how the register-interest command
+ * reads the message part that carries its interest result policy.
+ *
+ * <p>
+ * A client op builds a register-interest request whose policy part carries a type other than the
+ * policy argument, and sends it. The helper type records whether an instance of it is created on
+ * the server while the part is read. The server must read the part only as its expected policy type
+ * and refuse a part carrying any other type.
+ */
+@Category({ClientServerTest.class})
+public class RegisterInterestPolicyPartIntegrationTest {
+
+  private static final String REGION_NAME = "region";
+
+  @Rule
+  public ServerStarterRule server =
+      new ServerStarterRule().withRegion(RegionShortcut.REPLICATE, REGION_NAME).withAutoStart();
+
+  private PoolImpl pool;
+
+  @Before
+  public void setUp() {
+    OtherPartType.reset();
+    final PoolFactory poolFactory = PoolManager.createFactory();
+    poolFactory.addServer("localhost", server.getPort());
+    poolFactory.setReadTimeout(10_000);
+    poolFactory.setMinConnections(1);
+    pool = (PoolImpl) poolFactory.create("testPool");
+  }
+
+  @After
+  public void tearDown() {
+    if (pool != null) {
+      pool.destroy();
+    }
+  }
+
+  @Test
+  public void serverDoesNotProduceAnotherTypeFromThePolicyPart() {
+    try {
+      pool.execute(new PolicyPartOfAnotherTypeOp(REGION_NAME));
+    } catch (final Exception ignored) {
+      // The request does not complete: the point of interest is which type the server produced
+      // while reading the part, which is recorded independently below.
+    }
+
+    assertThat(OtherPartType.instantiated)
+        .as("reading the policy part must not produce a type other than the policy on the server")
+        .isFalse();
+  }
+
+  /**
+   * A register-interest request whose policy part carries a type other than the policy argument.
+   * Sends the request and does not attempt to interpret the response.
+   */
+  private static class PolicyPartOfAnotherTypeOp extends AbstractOp {
+
+    PolicyPartOfAnotherTypeOp(final String region) {
+      super(MessageType.REGISTER_INTEREST, 7);
+      getMessage().addStringPart(region, true);
+      getMessage().addIntPart(InterestType.KEY.ordinal());
+      getMessage().addObjPart(new OtherPartType());
+      getMessage().addBytesPart(new byte[] {(byte) 0x00});
+      getMessage().addStringOrObjPart("key");
+      getMessage().addBytesPart(new byte[] {(byte) 0x00});
+      getMessage().addBytesPart(new byte[] {(byte) DataPolicy.REPLICATE.ordinal(), (byte) 0x01});
+    }
+
+    @Override
+    protected Message createResponseMessage() {
+      return new ChunkedMessage(1, KnownVersion.CURRENT);
+    }
+
+    @Override
+    protected Object processResponse(final Message msg) throws Exception {
+      // Drain the whole response so this op does not return until the server has finished
+      // handling the request.
+      final ChunkedMessage chunkedMessage = (ChunkedMessage) msg;
+      chunkedMessage.readHeader();
+      do {
+        chunkedMessage.receiveChunk();
+      } while (!chunkedMessage.isLastChunk());
+      return null;
+    }
+
+    @Override
+    protected boolean isErrorResponse(final MessageType msgType) {
+      return false;
+    }
+
+    @Override
+    protected long startAttempt(final ConnectionStats stats) {
+      return 0;
+    }
+
+    @Override
+    protected void endSendAttempt(final ConnectionStats stats, final long start) {}
+
+    @Override
+    protected void endAttempt(final ConnectionStats stats, final long start) {}
+  }
+
+  /**
+   * A serializable type other than the register-interest policy argument. It records whether an
+   * instance of it is created, so a test can tell which type a part produced.
+   */
+  public static class OtherPartType implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    static volatile boolean instantiated = false;
+
+    static void reset() {
+      instantiated = false;
+    }
+
+    private void readObject(final ObjectInputStream in) throws IOException, ClassNotFoundException {
+      in.defaultReadObject();
+      instantiated = true;
+    }
+  }
+}