SofaBootRpcStartListener 还未跟随新版本 5.13.2 更新 lookout 移除问题

[Jiiiiiin]

SofaBootRpcStartListener 还未跟随新版本 5.13.2 更新 lookout 移除问题

#1447 但是上游 sofa-boot 特别是 rpc-sofa-boot-starter SofaBootRpcStartListener 缺失更新：

Your scenes

• sofa-boot 3.24.0

• sofa-rpc-all 单独更新:

  <rpc.core.version>5.13.2</rpc.core.version>

  <sofa.bolt.version>1.6.10</sofa.bolt.version>

  <sofa.hessian.version>3.5.5</sofa.hessian.version>
  <tracer.core.version>3.1.6</tracer.core.version>
  <sofa.common.tools.version>1.4.0</sofa.common.tools.version>

  <commons-io.version>2.14.0</commons-io.version>
  <guava-jre.version>32.0.0-jre</guava-jre.version>
  <netty.version>4.1.44.Final</netty.version>

  <resteasy.version>3.14.0.Final</resteasy.version>

  <javassist.version>3.29.2-GA</javassist.version>
  <bytebuddy.version>1.9.8</bytebuddy.version>

  <logback.version>1.2.13</logback.version>

Your advice

因为有些 CVE 内部检测，需要单独更新 sofa-rpc-all

Environment

• SOFARPC version:5.13.2
• JVM version (e.g. java -version):openjdk version "1.8.0_422"
• OS version (e.g. uname -a): Darwin

[Jiiiiiin]

目前仅仅能在项目，直接“覆盖”：

package com.alipay.sofa.rpc.event;

/**
 * Collect the raw information for lookout by listening to events.
 *
 * @author <a href="mailto:[email protected]">LiWei.Liangen</a>
 */
public class LookoutSubscriber extends Subscriber {

  public static void setLookoutCollectDisable(boolean lookoutCollectDisable) {
    // LookoutSubscriber.lookoutCollectDisable = lookoutCollectDisable;
  }

  @Override
  public void onEvent(Event event) {

  }
}

如果移除了整个 lookout 那么感觉这个应该没有影响。

已经向下游提交修复，但是不知道是否合规：

sofastack/sofa-boot#1348

sofastack/sofa-boot#1347