Merge pull request #237 from gockle/main

v3.3.9

Author: abewub

CHANGELOG.md

@@ -6,6 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [3.3.9] - 2025-06-09
+
+### Security
+
+- Update Jmeter to 5.6.3 to resolve issue with groovy scripts.
+- Update Jmeter-plugin-manager to 1.11 to resolve [CVE](https://nvd.nist.gov/vuln/detail/CVE-2025-48734)
+- Remove setuptools older distributions in the ECR Image.
+
 ## [3.3.8] - 2025-05-22
 
 ### Security
@@ -28,8 +36,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changes
 
-- Updating lambda runtimes to use node-20.
 - Updated Dockerfile results in an [image of size 424 MB instead of the earlier 2.2 GB](https://gallery.ecr.aws/aws-solutions/distributed-load-testing-on-aws-load-tester), this results in improved test start times, depending on the task count, a 500 task count tests starts 40% faster than the previous version of the solution.
+- Updating lambda runtimes to use node-20
 
 ## [3.3.5] - 2025-03-17
 

VERSION.txt

@@ -1 +1 @@
-3.3.8
+3.3.9

deployment/ecr/distributed-load-testing-on-aws-load-tester/.bzt-rc

@@ -0,0 +1,31 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+modules:
+  jmeter:
+    path: ~/.bzt/jmeter-taurus/{version}/bin/jmeter
+    download-link: https://archive.apache.org/dist/jmeter/binaries/apache-jmeter-{version}.zip
+    version: 5.6.3
+    force-ctg: true
+    detect-plugins: true
+    fix-jars: true
+    plugins:
+    - jpgc-json
+    - jmeter-ftp
+    - jpgc-casutg
+    - jpgc-dummy
+    - jpgc-ffw
+    - jpgc-fifo
+    - jpgc-functions
+    - jpgc-perfmon
+    - jpgc-prmctl
+    - jpgc-tst
+    - jpgc-udp
+    - bzm-http2
+    - bzm-random-csv
+    plugins-manager:
+      download-link: https://search.maven.org/remotecontent?filepath=kg/apc/jmeter-plugins-manager/{version}/jmeter-plugins-manager-{version}.jar
+      version: '1.11'
+    command-runner:
+      download-link: https://search.maven.org/remotecontent?filepath=kg/apc/cmdrunner/{version}/cmdrunner-{version}.jar
+      version: 2.3

deployment/ecr/distributed-load-testing-on-aws-load-tester/Dockerfile

@@ -8,8 +8,10 @@ ENV PIP_INSTALL="pip3.11 install --no-cache-dir"
 
 
 # install bzt
-RUN $PIP_INSTALL --upgrade bzt awscli setuptools==78.1.1 h11 && \
+RUN $PIP_INSTALL --upgrade bzt awscli setuptools==78.1.1 h11 urllib3==2.2.2 && \
     $PIP_INSTALL --upgrade bzt
+COPY ./.bzt-rc /root/.bzt-rc
+RUN chmod 755 /root/.bzt-rc
 
 # install bzt tools
 RUN bzt -install-tools -o modules.install-checker.exclude=selenium,gatling,tsung,siege,ab,k6,external-results-loader,locust,junit,testng,rspec,mocha,nunit,xunit,wdio,robot,newman
@@ -26,10 +28,12 @@ RUN chmod 755 /bzt-configs/jar_updater.py
 RUN python3.11 /bzt-configs/jar_updater.py
 
 # Remove jar files from /tmp
-RUN rm -rf /tmp/jmeter-plugins-manager-1.7*
+RUN rm -rf /tmp/jmeter-plugins-manager-1* && \
+    rm -rf /usr/local/lib/python3.11/site-packages/setuptools-65.5.0.dist-info && \
+    rm -rf /usr/local/lib/python3.11/site-packages/urllib3-1.26.17.dist-info
 
 # Add settings file to capture the output logs from bzt cli
 RUN mkdir -p /etc/bzt.d && echo '{"settings": {"artifacts-dir": "/tmp/artifacts"}}' > /etc/bzt.d/90-artifacts-dir.json
 
 WORKDIR /bzt-configs
-ENTRYPOINT ["./load-test.sh"]
+ENTRYPOINT ["./load-test.sh"]

deployment/ecr/distributed-load-testing-on-aws-load-tester/jar_updater.py

@@ -12,7 +12,7 @@
 jar_updater.py updates following jar files to address CVEs on the taurus image. this is not DLT application code. 
 the script may be removed once taurus updates the libraries on the image.
 Affected Jmeter jars:
-    * json-smart v2.4.8 will be replaced with v2.4.10
+    * json-smart v2.5.0 will be replaced with v2.5.2
     * neo4j-java-driver v4.12.0 will be replaced with v5.14.0
     * batik-script v1.14 will be replaced with v1.17
     * batik-bridge v1.14 will be replaced with v1.17
@@ -29,7 +29,7 @@
 # component name and download link in https://repo1.maven.org/maven2/
 # These are Components with regards to JMETER
 JMETER_COMPONENTS = {
-    "json-smart": "net/minidev/json-smart/2.4.10/json-smart-2.4.10.jar",
+    "json-smart": "net/minidev/json-smart/2.5.2/json-smart-2.5.2.jar",
     "neo4j-java-driver": "org/neo4j/driver/neo4j-java-driver/5.14.0/neo4j-java-driver-5.14.0.jar",
     "batik-script": "org/apache/xmlgraphics/batik-script/1.17/batik-script-1.17.jar",
     "batik-bridge": "org/apache/xmlgraphics/batik-bridge/1.17/batik-bridge-1.17.jar",
@@ -39,10 +39,14 @@
     "tika-core": "org/apache/tika/tika-core/1.28.4/tika-core-1.28.4.jar",
     "json-path": "com/jayway/jsonpath/json-path/2.9.0/json-path-2.9.0.jar",
     "dnsjava": "dnsjava/dnsjava/3.6.1/dnsjava-3.6.1.jar",
-    "xstream":"com/thoughtworks/xstream/xstream/1.4.21/xstream-1.4.21.jar"
+    "xstream":"com/thoughtworks/xstream/xstream/1.4.21/xstream-1.4.21.jar",
+    "http2-hpack": "org/eclipse/jetty/http2/http2-hpack/11.0.16/http2-hpack-11.0.16.jar",
+    "jetty-http": "org/eclipse/jetty/jetty-http/12.0.12/jetty-http-12.0.12.jar",
+    "http2-common": "org/eclipse/jetty/http2/http2-common/11.0.20/http2-common-11.0.20.jar",
+    "kotlin-stdlib": "org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar",
 }
-JMETER_VERSION = "5.5"
-JMETER_PLUGINS_MANAGER_VERSION = "1.10"
+JMETER_VERSION = "5.6.3"
+JMETER_PLUGINS_MANAGER_VERSION = "1.11"
 CMD_RUNNER_VERSION = "2.3"
 # To add other platform, and what to update, add affected components and version HERE
 

solution-manifest.yaml

@@ -0,0 +1,12 @@
+id: SO0062
+name: distributed-load-testing-on-aws
+version: 3.3.9
+cloudformation_templates:
+  - template: distributed-load-testing-on-aws.template
+    main_template: true
+  - template: distributed-load-testing-on-aws-regional.template
+    main_template: false
+build_environment:
+    build_image: 'aws/codebuild/standard:7.0'
+container_images:
+  - distributed-load-testing-on-aws-load-tester

source/api-services/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "api-services",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "description": "REST API micro services",
   "repository": {
     "type": "git",

source/api-services/package.json

@@ -1,6 +1,6 @@
 {
   "name": "distributed-load-testing-on-aws-ui",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "private": true,
   "license": "Apache-2.0",
   "author": {

source/console/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "custom-resource",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "description": "cfn custom resources for distributed load testing on AWS workflow",
   "repository": {
     "type": "git",

source/console/package.json

@@ -1,6 +1,6 @@
 {
   "name": "distributed-load-testing-on-aws-infrastructure",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "author": {
     "name": "Amazon Web Services",
     "url": "https://aws.amazon.com/solutions"

source/custom-resource/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "metrics-utils",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "main": "index.ts",
   "license": "Apache-2.0",
   "description": "Distributed Load Testing on AWS Ops Metrics",

source/custom-resource/package.json

@@ -1,6 +1,6 @@
 {
   "name": "source",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "private": true,
   "description": "ESLint and prettier dependencies to be used within the solution",
   "license": "Apache-2.0",

source/infrastructure/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "real-time-data-publisher",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "description": "Publishes real time test data to an IoT endpoint",
   "repository": {
     "type": "git",

source/infrastructure/package.json

@@ -1,6 +1,6 @@
 {
   "name": "results-parser",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "description": "result parser for indexing xml test results to DynamoDB",
   "repository": {
     "type": "git",

source/metrics-utils/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "solution-utils",
-  "version": "3.3.8",
+  "version": "3.3.9",
   "description": "Utilities package for Distributed Load Testing on AWS",
   "license": "Apache-2.0",
   "author": {