November 2021 Release Notes - Version 21.11.0

The winter ❄️ holidays are coming, so here is an early gift 🎁 from us to you: the November release ☃️

Util

util-security: Use snakeyaml to parse yaml instead of a buggy custom yaml parser. This means that thrown IOExceptions have been replaced by YAMLExceptions. Additionally, the parser member has been limited to private visibility. 3643e1e8

util-security: Any valid yaml / json file with string keys and values can be loaded with com.twitter.util.security.Credentials. 3643e1e8

util-cache: Update Caffeine cache library to version 2.9.2 c1d62105
util-jackson: Enable BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES in ScalaObjectMapper to guard against Remote Code Execution (RCE) security vulnerability. This blocks polymorphic deserialization from unsafe base types. 35f262f2

scrooge-serializer: concrete implementations of the ThriftStructSerializer trait in the c.t.scrooge. package now cache the value of its maxReusableBufferSize flag for the duration of the application. This improves performance but also makes them not observe changes to the flag. The value of this flag typically does not change during run time of an application, so this is deemed an acceptable tradeoff. 064e1535

finagle-base-http: Promote several classes out of exp experimental package: c.t.f.http.{GenStreamingSerialServerDispatcher, IdentityStreamTransport, StreamTransport} along with internal support classes. 81169d53

finagle-core: Remove c.t.f.loadbalancer.Balancer.maxEffort. Remove the maxEffort argument from Balancers.{p2c, p2cPeakEwma, aperture, aperturePeakEwmaUse, roundRobin}. 25f01f77
finagle-core: c.t.f.tracing.ClientRequestTracingFilter has been removed. Record relevant tracing information in your service or client directly. bcd89491
finagle: Remove com.twitter.finagle.Group, and other rarely used and deprecated pieces that depend on it com.twitter.finagle.memcached.TwitterCacheResolver, com.twitter.finagle.memcached.CacheNodeGroup, com.twitter.finagle.memcached.RubyMemCacheClient, and com.twitter.finagle.memcached.PHPMemCacheClient. Instead of Group, please use Var[Set[T]] or Activity[Set[T]] directly instead. f6021319

inject-core: Introduce a runAfterAll hook in c.t.inject.IntegrationTestMixin to allow for running logic to clean-up test resources in the org.scalatest.BeforeAndAfterAll#afterAll without needing to 1) override org.scalatest.BeforeAndAfterAll#afterAll, 2) ensure super is called for other resources clean-up, and 3) ensure all resources get cleaned up, regardless of non-fatal exceptions thrown as part of the clean-up logic and otherwise fail the TestSuite run. 42c17b87

http-server (BREAKING API CHANGE): Will now serialize many self-referential Jackson types as “{}” instead of returning a serialization error. See https://github.com/FasterXML/jackson-databind/commit/765e2fe1b7f6cdbc6855b32b39ba876fdff9fbcc for more details. 044293fe

No Changes