Aerospike REST Gateway Release Notes

Security

• [APPS-1290] - Fix org.bouncycastle:bcprov-jdk18on Infinite loop vulnerability.
• [APPS-1291] - Fix org.apache.tomcat.embed:tomcat-embed-core Insufficient Session Expiration.

Security

• [APPS-1135] - (REST) Fix Denial of Service (DoS) - CVE-2023-1370
• [APPS-1168] - (REST) Fix Open Redirect - CVE-2024-22243
• [APPS-1170] - (REST) Fix Open Redirect - CVE-2024-22259
• [APPS-1171] - (REST) Fix Denial of Service (DoS) - CVE-2024-23672
• [APPS-1172] - (REST) Fix Denial of Service (DoS) - CVE-2024-24549

Security

• [APPS-1108] - Address various vulnerabilities.

Bug Fixes

• [APPS-886] - Swagger API documentation does not display acceptable values for model 'type' fields.
• [APPS-887] - Swagger API documentation does not correctly display the required fields for Operation models.
• [APPS-941] - Fix http2 rapid-reset vulnerability CVE-2023-44487.

Improvements

• [APPS-882] - Clarify how to provide GeoJSON bin types in the documentation.

Bug Fixes

• [APPS-884] - GeoJSON bins are inserted as Aerospike Maps.

Improvements

• [APPS-866] - Upgrade to aerospike-java-client version 7.1.0.

Bug Fixes

• [APPS-833] - Upgrade to aerospike-java-client version 7 (addresses CVE-2023-36480).

Improvements

• [APPS-599] - REST: Add support for MAP_ORDERED and MAP_UNORDERED Map operation return types added in aerospike server 6.3.

Bug Fixes

• [APPS-652] - REST: Using a sindex filter and pagination causes infinite pages to be returned. #124
• [APPS-657] - REST: Support batch requests for server versions 5.x. #118
• [APPS-697] - REST: Address CVE-2023-20860.
• [APPS-730] - REST: Address CVE-2022-1471.

• Renamed package from aerospike-client-rest to aerospike-rest-gateway.

Bug Fixes

• [APPS-336] - REST: Fails to start when aerospike.restclient.requireauthentication=true.

• BREAKING CHANGE
  • The project now relies on Java 17.
  • The /v1/batch endpoint has been redesigned to support BatchWrite, BatchUDF, and BatchDelete. See https://aerospike.github.io/aerospike-rest-gateway/.
  • The steps to add a ctx to an Operation model have changed. The new method allows multiple CTX models to be provided instead of just one. Allowing for operations to be performed on nested CDTs. See https://aerospike.github.io/aerospike-rest-gateway/.
  • /v1/operation and /v1/execute endpoints are deprecated and will be removed. Please switch to using /v2/operate and /v2/execute. The new endpoints make use of robustly documented Operation models. See https://aerospike.github.io/aerospike-rest-gateway/ for more details.
• Full Changelog: 1.11.0...2.0.0.

New Features

• [APPS-25] - Support 6.0 partition query with pagination. (#75)
• [APPS-20] - Support 6.0 batch write, batch UDF, and batch delete. (#75)

Improvements

• [APPS-315] - Document Operation models in swagger. See https://aerospike.github.io/aerospike-rest-gateway/ for the new models. (#80)
• [APPS-63] - Add 'EXISTS' return type for CDT read operations. (#80)
• [APPS-21] - Support 6.0 truncate, udf-admin, and sindex-admin privileges. (#75)
• GeoJSON is now supported as a bin value with JSON. Look at docs/data-formats.md for more info. (#75)
• There are now spring-boot, circuit breaker, and tomcat metrics exposed from http://localhost:8080/actuator/prometheus.

Bug Fixes

• [APPS-285] - Cleanup client on cache eviction to stop runaway file descriptors. (#76)
• [APPS-288] - Support operations on CDTs by allowing multiple CTX objects. (#80)

Updates

• Update Java 1.8 to Java 17 (#80)
• Upgrade springboot from 2.5.12 to 2.7.4 (#84)
• Configure Dependabot (#51)
• Bump spring-retry from 1.3.1 to 1.3.4 (#81)
• Bump jackson-dataformat-msgpack from 0.9.0 to 0.9.3 (#82)
• Bump springdoc-openapi-ui from 1.6.11 to 1.6.12 (#83)
• Bump spring-aspects from 5.3.13 to 5.3.23 (#77)
• Bump aerospike-document-api from 1.1.1 to 1.2.0 (#72)

New Features

• Return user key if it exists on scan.

Improvements

• Use scanAll in case the maxRecords is not specified.
• Improve documentation.
• Tidy up tests.

Bug Fixes

• Repair build stage in Dockerfile.

Updates

• Upgrade Spring Boot to 2.5.12 (fixes cve-2022-22965).

Updates

• Upgrade log4j2 to 2.17.0 (fixes CVE-2021-45105).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.16.0 (fixes CVE-2021-44228).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade Aerospike Java client to 5.1.11.
• Upgrade log4j2 to 2.15.0 (fixes CVE-2021-44228).
• Upgrade Gradle Wrapper to 7.3.1.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Improvements

• Improve OpenAPI documentation.
• Add a Swagger UI site on GitHub Pages.
• Document how to generate a client/server using Swagger Editor.

Updates

• Upgrade Spring Boot to 2.5.6.
• Upgrade Aerospike Java client to 5.1.9.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.
• Dependencies
  • Upgrade Gradle to 7.2.
  • Upgrade Spring Boot to 2.5.5.

Improvements

• Documentation: Migrate from Swagger 2 to OpenAPI 3.
• Documentation: Add Getting Started blog posts section.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.17.0 (fixes CVE-2021-45105).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.16.0 (fixes CVE-2021-44228).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

New Features

• [CLIENT-1568] - Add support for the Document API operations.
• [CLIENT-1477] - Support a serialized Filter Expression as a parameter.
• [CLIENT-1596] - Update the client policies.
• [CLIENT-1587] - Support batch read operations.
• [CLIENT-1583] - Support PKI Authentication.
• [CLIENT-1539] - Remove sample app.
• Upgrade Aerospike Java client to 5.1.8.

Improvements

• Tidy up tests.
• Improve documentation.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.17.0 (fixes CVE-2021-45105).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.16.0 (fixes CVE-2021-44228).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

New Features

• [CLIENT-1524] - Support user quotas and statistics - REST Support user quotas and statistics.
• Add useBoolBin configuration property.
• Set userKey parameter as required in batch read operations #31.
• Add circuit breaker to the Record and Operate services.
• Expose the minimum connections as a configuration property.
• Add default property values to the application.properties file.
• Upgrade Aerospike Java client to 5.1.0
• Upgrade Spring Boot to 2.4.5.
• Update the demo project dependencies.

Improvements

• Improve documentation.
• Migrate the demo project to Yarn 2.
• Migrate from Travis CI to GitHub Actions.

Bug Fixes

• Remove obsolete Priority field from policies.
• [CLIENT-1484] - Remove deprecated scan policies - REST Remove deprecated scan policies.
• Use sha256 as a key in AerospikeClientPool.
• Fix multiple dependency vulnerabilities in the demo project.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.17.0 (fixes CVE-2021-45105).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.16.0 (fixes CVE-2021-44228).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application uses scans, we strongly recommend that you upgrade to REST Gateway 1.10.4 at the earliest opportunity.

New Features

• [CLIENT-1392] - Fix Swagger documentation.
• [CLIENT-1405] - Ensure K-ordered and KV-ordered maps are in order for CDT operations.
• [CLIENT-1365] - Support Aerospike Expression filters.
• Upgrade demo project dependencies.
• Upgrade Java Aerospike client to 5.0.2.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.17.0 (fixes CVE-2021-45105).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.16.0 (fixes CVE-2021-44228).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Updates

• Upgrade log4j2 to 2.15.0 (fixes CVE-2021-44228).

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

New Features

• [CLIENT-1351] - Expose ClientPolicy authMode configuration parameter.
• Upgrade demo project dependencies.
• Upgrade Java Aerospike client to 4.4.17.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

New Features

• Upgrade Spring Boot to 2.3.1.

Improvements

• Add examples and improve documentation.

Bug Fixes

• Annotate defaultClient as Nullable.
• Add security enabled condition to the InvalidUserAuthentication test.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Features

• Support multi-user tenancy.

• Upgrade Java Aerospike client to 4.4.15.

Fixes

• Resolve Swagger parameter duplication in ScanController.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Features

• Support write operations in background scan.

• Improve Swagger documentation.

• Upgrade Java Aerospike client to 4.4.12.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Features

• Support paginated scan functionality.

• Support BYTE_ARRAY and GEO_JSON bins in Json format.

• Upgrade Java Aerospike client to 4.4.11.

Fixes

• Rename bins query parameter to fix naming collision.

• Fix predicate expressions documentation.

• A bug affecting this version of the REST Gateway has been identified.
  • If your application talks to Aerospike Server version 4.9 or later, you can safely upgrade to REST Gateway 1.10.4. We strongly recommend that you do so at the earliest opportunity.

Features

• Support relative CDT operations.

• Support delete record operation in operate().

• Support nested CDT operations.

• Support predicate expressions.

• Support client server compression.

• Support bitwise operations.

• Support creation of list/map in a CDT context.

• Support HyperLogLog operations.

• Upgrade Java Aerospike client to 4.4.10.

Fixes

• Skip tests on make build.

• Align swagger documentation with all supported query parameters.

Features

• Project Dockerization.

• Migration from .war to .jar build.

• Make use of enum instead of raw strings for Operations, for better swagger documentation.

• Upgrade dependencies to the latest version.

• Fix Travis build.

Features

• Update Version of Java Client to 4.4.2.

• Raise an error when a top level operation object contains an invalid key.

Fixes

• Fix incorrect default value of replica policy.

• Throw proper exception when cluster is unstable during calls to the v1/cluster endpoint.

Features

• Add Support for TLS Configuration between REST Gateway and Aerospike Server.

Fixes

• Fix Wrong status code being returned when using an Operation on a non existent record.

Features

• Add documentation for new query Parameters readModeAP and readModeSC

Fixes

• Fix invalid generated Swagger specification file.

Features

• Introduced Aerospike REST Gateway Support for single record requests. (kvs) Support for multiple record reads with a single request. (batch) Support for single record, multiple operations. (operate) Support for info calls. (info) Support Secondary Index modification. (index) Support Namespace/Set truncation. (truncate) * Support for User and Role admininistration. (admin) (Requires Aerospike Enterprise Edition)