Bump storm.version from 2.8.9 to 3.1.0

[dependabot]

Bumps storm.version from 2.8.9 to 3.1.0.
Updates org.apache.storm:storm-client from 2.8.9 to 3.1.0

Release notes

Sourced from org.apache.storm:storm-client's releases.

Apache Storm 3.1.0

What's Changed

🚀 New Features

• Add ui.enable.jsonp to control JSONP callback wrapping in UI and Logviewer API responses by @​rzo1 in apache/storm#8977
• Add storm-iceberg module: an Apache Iceberg sink bolt by @​GGraziadei in apache/storm#8950
• Sync checkstyle config with upstream google_checks.xml by @​sercuzz8 in apache/storm#8969

🐛 Bug Fixes

• Return only the log files the requesting user may access from the log file listing by @​rzo1 in apache/storm#8974
• Change the worker log file permission only for download requests that are served by @​rzo1 in apache/storm#8978
• Reject image tags that are neither mapped nor valid image hashes before building the manifest path by @​rzo1 in apache/storm#8983
• Update StormSubmitter logging behavior by @​GGraziadei in apache/storm#8992
• Reject blobstore map local names that resolve outside the topology and worker directories by @​rzo1 in apache/storm#8981
• Stop echoing the request Origin with allow-credentials in logviewer JSON responses by @​rzo1 in apache/storm#8975
• Reject submitted jar locations that are not inside the Nimbus inbox by @​rzo1 in apache/storm#8980
• Verify the peer identity of the Netty TLS server the worker client connects to by @​rzo1 in apache/storm#8987
• Give each uploaded dependency artifact its own blob key instead of reusing a pre-existing blob by @​rzo1 in apache/storm#8982
• Require Kryo class registration in the state serializer by @​GGraziadei in apache/storm#8990
• Return a normalized copy of the topology conf from Nimbus by @​GGraziadei in apache/storm#8991
• Add to instead of replace Jetty's default TLS exclusions on HTTPS connectors by @​rzo1 in apache/storm#8979
• Pass only the required Kafka consumer properties to the spout lag monitor by @​rzo1 in apache/storm#8988
• Restrict topology scheduler strategies to the shipped strategies when no allowlist is configured by @​rzo1 in apache/storm#8986
• Decode netty server frames only after the handshake completes by @​GGraziadei in apache/storm#8993
• Set the CORS filter credentials parameter explicitly instead of a header name the filter ignores by @​rzo1 in apache/storm#8976
• BugFix Utils.java by @​ZBaldi in apache/storm#8972
• Apply the configured log user and group lists to daemon log requests by @​rzo1 in apache/storm#8973
• Generate tuple tree ids from a key stream instead of a recoverable linear congruential generator by @​rzo1 in apache/storm#8989
• Remove DRPC per-function request queues once they are empty by @​rzo1 in apache/storm#8985
• Validate topology.blobstore.map in rebalance conf overrides against the calling user by @​rzo1 in apache/storm#8999
• Evaluate nimbus.groups when nimbus.users is empty by @​rzo1 in apache/storm#8998
• Evaluate authorization for requests that carry no principal by @​GGraziadei in apache/storm#9005
• Apply the nimbus ACLs to listBlobs so callers only see blobs they may read by @​rzo1 in apache/storm#9000
• Read and check the docker command file before changing worker directory ownership by @​reiabreu in apache/storm#9007
• Authorize createStateInZookeeper requests like the other blob operations by @​rzo1 in apache/storm#9002
• Filter the topology history by the authenticated caller rather than the requested user name by @​rzo1 in apache/storm#9003
• Check the calling principal against the topology owner in uploadNewCredentials by @​rzo1 in apache/storm#9001
• STORM-3871: remove a topology's dependency artifact blobs when it is cleaned up by @​rzo1 in apache/storm#9011
• Reject a topology submission that lists a blob key which is not a dependency blob key by @​rzo1 in apache/storm#9012
• Validate the container id and invoke runc without a shell in reap-oci-container by @​reiabreu in apache/storm#9008
• Apply worker file ownership and mode via an open descriptor by @​reiabreu in apache/storm#9006
• Return independently owned value arrays from get_values by @​reiabreu in apache/storm#9013
• Restrict OCI bind-mount sources to configured directories and check the launch command username by @​reiabreu in apache/storm#9010
• Test the OCI launch-command username and mount-source enforcement by @​reiabreu in apache/storm#9014
• Require every UI API endpoint to declare its authorization by @​GGraziadei in apache/storm#9004
• Apply one redaction rule to configuration served and logged by Storm by @​rzo1 in apache/storm#9069
• Drop malformed tuple payloads instead of killing the receiving worker by @​L1nq0 in apache/storm#9076
• Harden the java serialization fallback bridge with a JEP-290 serial filter by @​L1nq0 in apache/storm#9075
• STORM-3871: sweep dependency blobs that outlive their topology's cleanup by @​rzo1 in apache/storm#9082

📦 Dependency Upgrades

... (truncated)

Commits

• 11d4032 [maven-release-plugin] prepare release v3.1.0
• d8ba1d5 Merge pull request #9082 from apache/STORM-3871-sweep-orphaned-dependency-blobs
• 8c1fdc1 STORM-3871: stop a non-leader nimbus from registering a deleted blob again
• a9fb804 STORM-3871: sweep dependency blobs that outlive their topology's cleanup
• f96065c Merge pull request #9080 from apache/dependabot/npm_and_yarn/storm-webapp/svg...
• 1553132 build(deps-dev): bump svgo from 4.0.2 to 4.1.0 in /storm-webapp
• d9dae3f Fix DeserializingConnectionCallbackTest negative-length assertion (#9081)
• 4152128 Harden the java serialization fallback bridge with a JEP-290 serial filter (#...
• cccc233 Drop malformed tuple payloads instead of killing the receiving worker (#9076)
• c030b1b Apply one redaction rule to configuration served and logged by Storm (#9069)
• Additional commits viewable in compare view

Updates org.apache.storm:flux-core from 2.8.9 to 3.1.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)