Update dependency com.twitter:finatra-http_2.11 to v20 - abandoned

[mend-for-github-com]

This PR contains the following updates:

Package	Update	Change
com.twitter:finatra-http_2.11	major	19.12.0 -> 20.12.0
com.twitter:finatra-http_2.11	major	2.9.0 -> 20.12.0

By merging this PR, the below issues will be automatically resolved and closed:

Severity	CVSS Score	CVE	GitHub Issue
Medium	6.1	CVE-2020-35774	#242

By merging this PR, the below issues will be automatically resolved and closed:

Severity	CVSS Score	CVE	GitHub Issue
High	9.1	CVE-2019-20444	#203
High	7.8	CVE-2017-15288	#18
High	7.5	CVE-2015-2156	#77
Medium	6.1	CVE-2020-35774	#242

---

Release Notes

twitter/finatra

v20.12.0

Added

* finatra-kafka-streams: Add async map commands to Kafka Streams DSL (`flatMapAsync`,
  `flatMapValuesAsync`, `mapAsync`, and `mapValuesAsync`) ``PHAB_ID=D593995``

* finatra-kafka-streams: Allow String configuration to be null and set upgradefrom to null if it is
   running in 2.5 kafka client.  ``PHAB_ID=D592608``

* finatra-http: Allow injecting filtered controllers in HttpRouter from Java. ``PHAB_ID=D590707``

* inject-utils: Move deprecation warning from `c.t.inject.conversions.map` to
  `c.t.inject.conversions.map.RichMap`. ``PHAB_ID=D591979``

* kafka: Add an option `includePartitionMetrics` to `KafkaFinagleMetricsReporter` to not include
  metrics per partition of the `FinagleKafkaConsumer`. Defaults to true. ``PHAB_ID=D587636``

* finatra: Enables cross-build for 2.13.1 for inject-logback. ``PHAB_ID=D588586``

* finatra-kafka-streams: Add delay DSL calls to insert a delay into a Kafka Streams topology.

* finatra: Enables cross-build for 2.13.1 for inject-thrift-client. ``PHAB_ID=D583509``

* finatra-kafka-streams: Add `c.t.f.k.t.s.PersistentTimerValueStore` which stores a value in the
  timerstore that can be used when the timer is triggered. ``PHAB_ID=D583020``

* inject-core: Add ability to call `InMemoryStats#waitFor` with a fixed timeout
  ``PHAB_ID=D576147``

* finatra: Enables cross-build for 2.13.1 for httpclient, http, and jackson. ``PHAB_ID=D574391``

Changed

• inject-utils: Deprecate all methods in c.t.inject.conversions.map.RichMap, and move
  functionality to c.t.conversions.MapOps in the util/util-core project. PHAB_ID=D578819

• inject-utils: Deprecate all methods in c.t.inject.conversions.tuple, and move functionality
  to c.t.conversions.TupleOps in the util/util-core project. PHAB_ID=D578804

• inject-utils: Deprecate all methods in c.t.inject.conversions.seq, and move functionality
  to c.t.conversions.SeqOps in the util/util-core project. PHAB_ID=D578605

• inject-utils: Remove deprecated camelify, pascalify, and snakify from
  c.t.inject.conversions.string.RichString. Additionally, deprecate toOption and
  getOrElse in c.t.inject.conversions.string.RichString, and move functionality to
  c.t.conversions.StringOps in the util/util-core project. PHAB_ID=D578549

• c.t.finatra.http.exceptions.ExceptionMapperCollection changed from Traversable to Iterable
  for cross-building 2.12 and 2.13. PHAB_ID=D574391

• inject-core: (BREAKING API CHANGE) Move the testing utility InMemoryStatsReceiverUtility
  and InMemoryStats into inject-core from inject-server. They can both be found under
  com.twitter.inject. PHAB_ID=D574643

• validation: (BREAKING API CHANGE) Introduce new Validation Framework APIs which support
  cascading validation to nested case classes and other improvements which also closer align
  to JSR380. Validator#validate has changed from returning Unit and throwing an exception
  to model the JSR380 version that returns a Set of failed constraints. There is a new method
  which replicates the throwing behavior. PHAB_ID=D559644

• kafka: Split c.t.f.kafka.tracingEnabled flag into c.t.f.k.producers.producerTracingEnabled and
  c.t.f.k.consumers.consumerTracingEnabled to selectively enable/disable tracing for
  producers/consumers. Producer tracing is turned on by default and consumer tracing is turned off
  by default now. PHAB_ID=D571064

Fixed

* inject-server: Wire through HTTP method in AdminHttpClient so that POST requests can be made to
  HTTPAdmin endpoints. ``PHAB_ID=D584988``

v20.10.0

Added

* finatra-kafka-streams: Add toCluster DSL call to publish to another Kafka cluster.
 ``PHAB_ID=D562195``

* jackson: Add support for validating `@JsonCreator` annotated static (e.g., companion
  object defined apply methods) or secondary case class constructors. ``PHAB_ID=D552921``

* inject-app: Allow injecting flags without default values as both `scala.Option` and
  `java.util.Optional`. ``PHAB_ID=D526226``

Changed

• utils: Undo usage of TypesApi for help in determining if a class is a Scala case class
  as this fails for generic case classes in Scala 2.11, failing some supported cases for
  Jackson processing. PHAB_ID=D566596

• utils: Update ClassUtils#simpleName to handle when package names have underscores
  followed by a number which throws an InternalError. Add tests. PHAB_ID=D566069

• utils: Revamp ClassUtils#isCaseClass to use the TypesApi for help in determining
  if a class is a Scala case class. Add tests. PHAB_ID=D566069

• http: The http server did not properly log the bound address on server startup. Fix this
  and make the thrift server consistent. PHAB_ID=D563758

• utils: (BREAKING API CHANGE) Rename maybeIsCaseClass to notCaseClass in
  ClassUtils and change the scope of the method. PHAB_ID=D556169

• http: Adding support for optionally passing chain in the TLS sever trait. PHAB_ID=D553718

• finatra: Bump version of Joda-Time to 2.10.8. PHAB_ID=D570496

Fixed

* finatra-kafka-streams: Revert AsyncTransformer to still use ConcurrentHashMap.
 ``PHAB_ID=D555422``

* inject-thrift-client: The `Singleton` annotation has been removed from the `DarkTrafficFilter` and
  the `JavaDarkTrafficFilter`. It was there in error. `PHAB_ID=D553539`

* inject-thrift-client: When using `RepRepServicePerEndpoint`, Finatra's `DarkTrafficFilter` would
  throw a `NoSuchMethodException` when trying to lookup an inherited Thrift endpoint.
  ``PHAB_ID=D553361``

v20.9.0

Added

* finatra-inject: `TestInjector` has been reworked to allow users executing modules' lifecycle
  callbacks. Specifically, the `TestInjector` builder API has been moved under `TestInjector.Builder`
  to allow `TestInjector` extends `Injector` with two new methods: `start()` and `close()`.
  ``PHAB_ID=D537056``

Changed

• finatra-kafka-streams: Update and separate the Finatra kafka stream code base which has direct
  dependency on Kafka 2.2. Separate any code which cannot easily be upgraded to separate build
  target. PHAB_ID=D545900

• inject-core: c.t.inject.Injector is now an abstract class. Use Injector.apply to create
  a new instance (versus the new Injector(...) before). PHAB_ID=D543297

• http: Ensure HttpWarmer creates the request exactly the number of times requested and
  mutates the correct objects. PHAB_ID=D547310

• kafka: Replaced the com.twitter.finatra.kafka.TracingEnabled toggle with a GlobalFlag enabling
  Zipkin tracing for Kafka clients. PHAB_ID=D525274

• finatra: Bump version of Jackson to 2.11.2. PHAB_ID=D538440

Fixed

* jackson: Fix issue in the handling of unknown properties. The `CaseClassDeserializer` only
  considered the case where the incoming JSON contained more fields than the case class and
  not the case where the incoming JSON contained less fields than specified in the case class.
  This has been fixed to ensure that when the fields of the JSON do not line up to the
  non-ignored case class fields the handling of unknown properties is properly invoked.
  ``PHAB_ID=D549353``

* validation: `c.t.f.validation.Validator` would throw an `IndexOutOfBoundsException` when
  trying to validate a case class which contained additional fields that are not included in the
  constructor parameters. ``PHAB_ID=D549253``

v20.8.1

Added

* thrift: `JavaThriftRouter` now allows mounting controllers by value (as opposed to via DI).
  ``PHAB_ID=D528659``

* finatra-kafka: Expose delivery timeout duration in KafkaProducerConfig. ``PHAB_ID=D535761``

Changed

• inject-core: Remove deprecated com.twitter.inject.Mockito trait. Users are encouraged to
  switch to the com.twitter.util.mock.Mockito trait from util/util-mock. PHAB_ID=D529174

Fixed

* inject-server: Ensure `Awaiter.any` does not try to block on an empty list of Awaitables. Add
  tests. ``PHAB_ID=D537727``

* finatra-jackson: Fix bugs around generic case class deserialization involving other generic
  types. Reported (with reproduction and pointers) on GitHub by @​aatasiei
  (https://github.com/twitter/finatra/issues/547). Fixes #​547. ``PHAB_ID=D532768``

* finatra-jackson: Fix a bug preventing JSON parsing of generic case classes, which in turn, contain
  fields with generic case classes. Reported (with a thorough reproducer and an analysis) on GitHub
  by @​aatasiei (https://github.com/twitter/finatra/issues/548). Fixes #​548. ``PHAB_ID=D531452``

v20.8.0

Added

* inject-app: Add more Java-friendly constructors for the TestInjector. ``PHAB_ID=D520900``

Changed

• inject-modules: Improve Java usability: rename apply to get for
  StatsReceiverModule and LoggerModule.
  Add get methods for other TwitterModule singleton objects.
  (BREAKING API CHANGE) PHAB_IB=D525696

• inject-core: Deprecate c.t.inject.Resettable (no replacement) and c.t.inject.TestTwitterModule.
  Users should prefer the #bind[T] DSL over usage of the TestTwitterModule. PHAB_ID=D520889

Fixed

* inject-server: Fix EmbeddedTwitterServer to return `StartupTimeoutException` when server under
  test fails to start within max startup time. ``PHAB_ID=D519318``

v20.7.0

Added

* inject-app: Adding flag converters for `java.io.File` (including comma-separated variants).
  ``PHAB_ID=D516020``

* finatra-kafka-streams: Added `TracingKafkaClientSupplier` to provide `TracingKafkaProducer` and
  `TracingKafkaConsumer` to enable Zipkin tracing. Tracing can be enabled with the toggle
  `com.twitter.finatra.kafka.TracingEnabled`.  ``PHAB_ID=D502911``

* finatra-kafka: Added `TracingKafkaProducer` and `TracingKafkaConsumer` to enable Zipkin tracing
  for Kafka. `FinagleKafkaProducerBuilder.build()` and `FinagleKafkaConsumerBuilder.buildClient()`
  now return instances of `TracingKafkaProducer` and `TracingKafkaConsumer` respectively with
  tracing enabled by default. Tracing can be enabled with the toggle
  `com.twitter.finatra.kafka.TracingEnabled`.  ``PHAB_ID=D490711``

Changed

• finatra: Update org.scalatest dependency to 3.1.2 and introduce finer-grained dependencies on
  org.scalatestplus artifacts. PHAB_ID=D518553 PHAB_ID=D518794

• inject-thrift-client: Remove unused ClientId property from
  ThriftMethodBuilderClientModule#provideServicePerEndpoint method. PHAB_ID=D513491

• inject-server: Improve startup time of EmbeddedTwitterServer by observing lifecycle events to
  determine startup, where previously we were doing 1 second polls. The nonInjectableServerStarted
  property is removed and isStarted should be referenced regardless of the type of underlying
  twitterServer type. The end result should see a faster test execution feedback loop. Our Finatra
  test targets range from a roughly 2x to 10x reduction in execution times.

  You may experience new test failures in cases where an exception is thrown as part of
  c.t.inject.TwitterServer.start() or c.t.server.TwitterServer.main() and the test would have
  expected a failure as part of startup. As the error takes place after the startup lifecycle,
  you may now need to Await.result the EmbeddedTwitterServer.mainResult() to assert the error.

  You may also experience some new non-deterministic behavior when testing against PubSub style
  logic. As the server may be started earlier, your tests may be relying on assumptions that
  an event would have occurred within the previous 1 second startup poll, which is no longer
  guaranteed. You may need to adjust your test logic to account for this behavior.

  PHAB_ID=D499999

• finatra: Update com.google.inject.guice dependency to 4.2.3 and net.codingwell.scala-guice
  to version 4.2.11. The net.codingwell.scala-guice library has switched from Manifests to TypeTags
  for transparent binding and injector key creation. The c.t.inject.TwitterModule has moved from its
  custom bind DSL to the scalaguice.ScalaModule which brings the TwitterModule inline with both the
  TwitterPrivateModule and the bind[T] test DSL to now have the same consistent binding DSL across
  all three. Thus, there is no more confusing bindSingleton function in the TwitterModule bind API.

  Upgrading scalaguice helps move a necessary dependency of Finatra to a version which is Scala 2.13
  compatible moving Finatra closer to Scala 2.13 support. PHAB_ID=D504559 PHAB_ID=D515857

Fixed

* inject-app: Having two sets of flag converters for primitive types (both Java and Scala) confuses
  the DI runtime, preventing the injection. We now have only a single set of converters, based off
  Scala primitive types.  ``PHAB_ID=D509192``

v20.6.0

Added

* inject-app: You can now inject Flag values of any type (not just primitive types). Most of the
  common Flag types are already supported out of the box (e.g., `Seq[InetSocketAddress]`), but it's
  also possible to register your own converters derived from any Flaggable instance.
  ``PHAB_ID=D498210``

* inject-stack: Move `StackTransformer` from `inject/inject-core` to `inject/inject-stack` to
  remove the finagle-core dependency from `inject/inject-core`. ``PHAB_ID=D489604``

* inject-server: adding httpPostAdmin test method. ``PHAB_ID=D482624``

Changed

• thrift/http: Introduce a Common Log Format <https://en.wikipedia.org/wiki/Common_Log_Format>__
  type of formatting for Thrift access logging to replace the current prelog text. Ensure
  the HTTP and Thrift access logging filters are aligned in functionality and behavior.
  PHAB_ID=D497596

• inject-slf4j: Remove Jackson dependency. Case classes which wish to use the slf4j Logging
  functionality should use the finatra/jackson c.t.finatra.jackson.caseclass.SerdeLogging
  trait which provides a @JsonIgnoreProperties to ignore logging fields. PHAB_ID=D487948

Fixed

* finatra-validation: Added a `c.t.finatra.validation.ValidatorModule` to provide a default
  Validator. The new module is added to the default Finatra HttpServer modules, users can override
  it with a customized `ValidatorModule` by overriding the `validatorModule` field.
  ``PHAB_ID=D503417``

v20.5.0

Added

* inject-mdc: Move MDC integration from `inject/inject-slf4j` to `inject/inject-mdc`.
  ``PHAB_ID=D485870``

* finatra-http|finatra-thrift: Update TraceIdMDCFilter to log traceSampled and traceSpanId
  ``PHAB_ID=472013``

* finatra-examples: Ensure there are Java and Scala examples for the different
  types of applications and servers which can be built with Finatra. Update `/examples`
  directory layout for discoverability and consistency. ``PHAB_ID=D469677``

Changed

• inject-slf4j: Move MDC integration from inject/inject-slf4j to inject/inject-mdc.
  PHAB_ID=D485870

• finatra-http: Allow extensions of the c.t.finatra.http.filters.HttpResponseFilter
  to specify how to set the Location Header value into a Response. Additionally, don't
  allow exceptions resulting from the inability to set a non-compliant 'Location' response
  header escape the filter. PHAB_ID=D483793

• inject-core: Make flag methods in c.t.inject.TwitterModule public an final. PHAB_ID=D484168

• inject-core: c.t.inject.Mockito has been marked deprecated. Users are encouraged to prefer
  mockito-scala <https://github.com/mockito/mockito-scala>_ (or ScalaTest MockitoSugar <http://doc.scalatest.org/3.1.1/#org.scalatestplus.mockito.MockitoSugar>_
  which provides some basic syntax sugar for Mockito). PHAB_ID=D482531

• http: (BREAKING API CHANGE) Update the c.t.finatra.http.HttpResponseFilter to optionally fully
  qualify response 'Location' header values. A previous change <https://github.com/twitter/finatra/commit/ff9acc9fbf4e89b532df9daf2b9cba6d90b2df96>_
  made the filter always attempt to fully qualify any response 'Location' header value. This updates
  the logic to be opt-in for the more strict returning of fully qualified 'Location' header values with
  the default being to allow relative values per the RFC7231 <https://tools.ietf.org/html/rfc7231#section-7.1.2>_
  which replaces the obsolete RFC2616 <https://tools.ietf.org/html/rfc2616#section-14.30>_. This is
  thus a breaking API change as the default is now to allow relative values. To enable the previous
  strict behavior, users should instantiate the filter with the constructor arg fullyQualifyLocationHeader
  set to 'true'. This addresses issue #​524. PHAB_ID=D467909

• jackson: Remove deprecated FinatraObjectMapper and FinatraJacksonModule. Users are encouraged
  to switch to the equivalent c.t.finatra.jackson.ScalaObjectMapper and
  c.t.finatra.jackson.modules.ScalaObjectMapperModule. PHAB_ID=D473177

• finatra-http: Update c.t.finatra.http.StreamingJsonTestHelper to not use Thread.sleep for
  writing JSON elements on an artificial delay. PHAB_ID=D470793

• inject-app: Remove finagle-core dependency. Introduce finatra/inject/inject-dtab.
  PHAB_ID=D474298

• finatra: Bump version of Jackson to 2.11.0. PHAB_ID=D457496

• finatra-http: Only create EnrichedResponse counters when needed. Any "service/failure"
  response counters will only be generated upon first failure and not eagerly for each
  response generated. This change impacts users who expect a counter value of 0 when no
  response failures have been encountered - now the counter will not exist until the first
  failure has been recorded. PHAB_ID=D474918

• finatra: Bump version of Joda-Time to 2.10.6. PHAB_ID=D473522

Fixed

* inject-thrift-client: Convert non-camel case `ThriftMethod` names, e.g., "get_tweets" to
  camelCase, e.g., "getTweets" for reflection lookup of generated `ReqRepServicePerEndpoint`
  interface methods in `c.t.inject.thrift.filters.DarkTrafficFilter`. ``PHAB_ID=D478104``

v20.4.1

Added

* inject-app: Add default type conversions for `java.time.LocalTime`, `c.t.util.Time`,
  `java.net.InetSocketAddress`, and `c.t.util.StorageUnit`. This allows the injector to convert from
  a String representation to the given type. The type conversion for `java.net.InetSocketAddress`
  uses the `c.t.app.Flaggable.ofInetSocketAddress` implementation and the type conversion for
  `c.t.util.Time` uses the `c.t.app.Flaggable.ofTime` implementation for consistency with Flag parsing.
  Because of the current state of type erasure with `c.t.app.Flag` instances, Finatra currently binds
  a parsed `c.t.app.Flag` value as a String type, relying on registered Guice TypeConverters to convert
  from the bound String type to the requested type. These conversions now allow for a `c.t.app.Flag`
  defined over the type to be injected by the type as Guice now has a type conversion from the bound
  String type rather than as a String representation which then must be manually converted.
  ``PHAB_ID=D471545``

* finatra-http: Method in tests to return an absolute path URI with the https scheme and authority
  ``PHAB_ID=D466424``

* finatra: Java-friendly `bindClass` test APIs. The `bindClass` API calls from Java can be
  now chained with the `TestInjector`, `EmbeddedApp`, `EmbeddedTwitterServer`,
  `EmbeddedThriftServer`, and `EmbeddedHttpServer`. For example, the following is now possible:

  ```
  EmbeddedHttpServer server = new EmbeddedHttpServer(
      new HelloWorldServer(),
      Collections.emptyMap(),
      Stage.DEVELOPMENT)
      .bindClass(Integer.class, Flags.named("magic.number"), 42)
      .bindClass(Integer.class, Flags.named("module.magic.number"), 9999);

  return server;
  ```
  ``PHAB_ID=D463042``

Changed

• inject-app: Introduce consistent c.t.app.Flag creation methods for Java. Bring HTTP and Thrift
  server traits inline with each other to provide consistent Java support. Ensure Java examples in
  documentation. PHAB_ID=D471716

• inject-core: Update the configuration of c.t.app.Flag instances created within a c.t.inject.TwitterModule
  to have failFastUntilParsed set to 'true' by default. While this is configurable for a given
  c.t.inject.TwitterModule, much like for the application itself, it is STRONGLY recommended that
  users adopt this behavior. PHAB_ID=D448047

• inject-app: Update c.t.inject.app.TestInjector to always add the InjectorModule.
  PHAB_ID=D465943

• inject-app: Reduce visibility of internal code in c.t.inject.app.internal. PHAB_ID=D465597

• inject-modules: Updated BUILD files for Pants 1:1:1 layout. PHAB_ID=D442977

Fixed

* finatra-kafka: Close a result observer when Namer.resolve fails. ``PHAB_ID=D416044``

v20.4.0

Added

* inject-app: Add Java-friendly `main` to `EmbeddedApp`. ``PHAB_ID=D458375``

* finatra-kafka: Expose timeout duration in KafkaProducerConfig dest(). ``PHAB_ID=D457356``

Changed

• finatra-validation|jackson: (BREAKING API CHANGE) Introduced new case class validation library
  inspired by JSR-380 specification. The new library can be used as its own to validate field and
  method annotations for a case class. The library is also automatically integrated with Finatra's
  custom CaseClassDeserializer to efficiently apply per field and method validations as request
  parsing is performed. However, Users can easily turn off validation during request parsing with
  the setting noValidation in their server configurations. For more information, please checkout
  Finatra User's Guide <https://docbird.twitter.biz/finatra/user-guide/index.html>__.
  PHAB_ID=D415743

• finatra: guice is upgraded to 4.2.1 PHAB_ID=D457714

v20.3.0

Added

Changed

• finatra-validation|jackson: Remove Jackson dependency from finatra/validation. This
  was for ErrorCode reporting but can be moved to finatra/jackson. PHAB_ID=D445364

• finatra-kafka-streams: (BREAKING API CHANGE) Update AsyncTransformer to preserve
  record context. PHAB_ID=D436227

• finatra-jackson: Better handling of Scala enumeration mapping errors. Currently, if mapping
  of a Scala enumeration during deserialization fails a java.util.NoSuchElementException is
  thrown which escapes deserialization error handling. Update to instead handle this failure case
  in order to correctly translate into a CaseClassFieldMappingException which will be wrapped
  into a CaseClassMappingException. PHAB_ID=D442575

Fixed

v20.1.0

Changed

* finatra-kafka-streams: Track `c.t.f.kafkastreams.flushing.AsyncProcessor` and
  `c.t.f.kafkastreams.flushing.AsyncTransformer` latencies with stat metrics ``PHAB_ID=D430688``

* finatra: Exposing Listening Server's bound address in Thrift and HTTP server traits
  ``PHAB_ID=D424745``

* finatra: Upgrade logback to 1.2.3 ``PHAB_ID=D415888``

Fixed
~~~~~

* inject-server: Fix issue in `c.t.inject.server.EmbeddedHttpClient` where assertion of an
  empty response body was incorrectly disallowed. This prevented asserting that a server
  was not yet healthy as the `/health` endpoint returns an empty string, thus even a not yet
  healthy server would report as "healthy" to the testing infrastructure as long as the `health`
  endpoint returned a `200 - OK` response. ``PHAB_ID=D422712``

---

• If you want to rebase/retry this PR, click this checkbox.

[mend-for-github-com]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.