Draft - Don't Merge to Main: Enhance JMeter SSL support, dependency updates, and HTTP improvements#143
Draft
3dgiordano wants to merge 35 commits into
Draft
Draft - Don't Merge to Main: Enhance JMeter SSL support, dependency updates, and HTTP improvements#1433dgiordano wants to merge 35 commits into
3dgiordano wants to merge 35 commits into
Conversation
…support. (#112) * Relative path support for SSL KeyStore/TrustStore * Improve SSL Keystore and Truststore support * Protection against failure when configuring TrustStore or KeyStore * Alias in the same JMeter thread
…115) * Gracefully handle JMeter keystore load failures * Reinitialize SSLManager and client for mTLS client cert test
* Preserve connection keep alive
* Catch HPACK errors and Set Dynamic Response Header Size
Bumps org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0. --- updated-dependencies: - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump org.assertj:assertj-core from 3.12.2 to 3.27.7 Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj) from 3.12.2 to 3.27.7. - [Release notes](https://github.com/assertj/assertj/releases) - [Commits](assertj/assertj@assertj-core-3.12.2...assertj-build-3.27.7) --- updated-dependencies: - dependency-name: org.assertj:assertj-core dependency-version: 3.27.7 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * fix: pin byte-buddy to 1.14.18 to resolve conflict between mockito-core 2.28.2 and assertj-core 3.27.7 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: David <dgiordano@perforce.com>
Bumps [guava](https://github.com/google/guava) from 29.0-jre to 32.0.0-jre. - [Release notes](https://github.com/google/guava/releases) - [Commits](https://github.com/google/guava/commits) --- updated-dependencies: - dependency-name: com.google.guava:guava dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: David <3dgiordano@gmail.com>
* Allow 401 without HTTP AUTH
* Customize header validation for HPACK. * Remove reflection and add shims to gain access * Test CustomHpackDecoder
* Delegate cached-resource sample result to JMeter HTTPHC4Impl * Fix flaky test
* Support file:// sampler URLs * Support file:// on embedded resources
…eter HTTP (#139) * Add headless CLI tool to migrate stock JMeter HTTP samplers to BlazeMeter HTTP * Cross compatibility 5.5 and 5.6.3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several important improvements to the project's build process, dependency management, and plugin compatibility. The main highlights are the introduction of multi-version JMeter testing in CI, updates to dependencies for better compatibility and security, and the addition of migration scripts and a CLI environment for headless operation. There are also targeted fixes and refactoring in HTTP/2 fallback and error handling logic.
CI/CD and Compatibility Improvements:
.github/workflows/ci-build.yaml) now tests against both JMeter 5.5 (minimum supported) and 5.6.3 (latest), ensuring plugin compatibility across versions. Artifacts are named per JMeter version. [1] [2].github/workflows/ci-jmeter-compatibility.yaml) now verifies the built plugin against all supported JMeter versions, not just the latest.Dependency Updates and Conflict Resolution:
pom.xml: JMeter to 5.5, Jetty to 12.1.11, Brotli4j to 1.23.0, HttpCore to 4.4.15, Commons Lang3 to 3.18.0, AssertJ to 3.27.7, and Guava to 32.0.0-jre. [1] [2] [3] [4] [5]byte-buddyandbyte-buddy-agentto 1.14.18 in test scope to resolve a classpath conflict between Mockito and AssertJ.Tooling and Scripts:
jmx-migrate.shandjmx-migrate.cmdscripts to migrate JMeter HTTP Request samplers to the BlazeMeter HTTP sampler, making migration easier for users on both Unix and Windows. [1] [2]JMeterCliEnvironment.javato bootstrap a headless JMeter environment for CLI tools, improving support for command-line utilities shipped with the plugin.HTTP/2 Fallback and Error Handling Refactor:
HTTP2FutureResponseListenerto centralize HTTP/1.1 fallback logic inHTTP2JettyClient, improved HPACK failure detection, and clarified protocol error handling to avoid unnecessary fallback attempts. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]Documentation and Comments:
DeflateContentDecoderFactory, to clarify implementation details and usage.Security
CVE-2026-2332 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') #119 and
CVE-2025-48924 - Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs #104
CVE-2026-24400 - AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion #105
CVE-2023-2976 - Guava vulnerable to insecure use of temporary directory #52
CVE-2020-8908 - Information Disclosure in Guava #52