LoginSign Up
← Back to all sparks
A

Apache Storm

ANALYTICS
Velocity6.3

Distributed real-time computation system

storm.apache.org ↗

Storm 3.0 finishes removing the Clojure it was built in, and moves to a Java 21 baseline.

stream-processingmodernizationsecurityschedulerjvmperformance
◆Current state
Storm is running two lines: a 2.8.x maintenance branch that is mostly Dependabot traffic punctuated by real security releases, and the new 3.0.0 line cut on 22 July. 3.0.0 removes all remaining Clojure from the codebase, raises the baseline to Java 21 (with master already on 25), and ships throughput work — zstd compression for thrift cluster state, tuple compression between workers, and decoupling of the control plane from the data plane on receive queues. The 2.8.6 and 2.8.7 releases earlier in the window carried four CVEs, including a deserialization RCE reachable by any user with topology submission rights.
◆Where it's heading
The project is converting itself from a legacy JVM codebase into an ordinary modern Java one, and the 3.0 work shows where that energy goes next: scheduling and queueing. Recent PRs add AIMD dynamic batch sizing to JCQueue, jitter metrics and a jitter-aware stream grouping, round-robin rebalance onto returning supervisors, and several fixes for stale or orphaned worker heartbeats. Alongside that, the distribution is being slimmed — optional Hadoop and Kafka dependencies were unbundled and shared jars de-duplicated. The 2.x branch is being kept alive for security and dependency currency, not for features.
◆Prediction
Expect 3.0.x point releases to concentrate on the scheduler and worker-lifecycle fixes that 3.0.0 opened up, and expect the 2.8.x line to keep receiving CVE backports while feature work stays on 3.x. The Java 25 baseline already on master suggests the next minor will move the floor again.

◆Recent moves

  1. 17d ago

    Storm 3.0 drops Clojure entirely and moves to Java 21

    ⚡ SPARK

    The release the 2.x maintenance work was holding the door open for: no Clojure left in the codebase, Java 21 as the baseline, and the first substantial throughput changes in years — compressed tuples and cluster state, and a control plane split off from the data plane on receive queues. It marks the point where Storm's roadmap stops being about carrying legacy and starts being about scheduling and queueing.

    View source ↗
  2. 17d ago

    2.8.9 is a dependency sweep with one Flux viewer guard

    Almost entirely Dependabot upgrades across the JVM and webapp dependency trees, plus a guard against js-yaml 5.x throwing on empty input in the Flux viewer. Published the same day as 3.0.0, which is the maintenance branch being brought current before attention moves to 3.x.

    View source ↗
  3. 17d ago

    2.8.8 backports a Kafka topology-lag fix

    One backported fix for Kafka topology lag breaking when no offsets are committed, a docs link migration, and a long dependency list. One of three 2.8.x releases cut within two minutes of each other on 22 July.

    View source ↗
  4. 3mo ago

    Two TLS CVEs fixed: JVM-wide downgrade and auth bypass

    Fixes a Prometheus reporter setting that replaced the default SSL context and downgraded TLS for the entire JVM, and a case where failed TLS client authentication fell back to an ANONYMOUS principal instead of being rejected. The second is the more serious pattern — an authorization check that silently passed when authentication failed.

    View source ↗
  5. 3mo ago

    Deserialization RCE and stored XSS in the UI are fixed

    Storm was deserializing the base64 TGT credential blob through ObjectInputStream with no class filtering, giving any user with topology submission rights remote code execution in Nimbus and worker JVMs; a second issue allowed stored XSS through unsanitized topology metadata in the UI. Together with 2.8.7 this makes the pre-2.8.6 line unsafe to run in any multi-tenant deployment.

    View source ↗
  6. 4mo ago

    2.8.5 is dependency upgrades plus small logging fixes

    Routine maintenance: a long Dependabot run, the commons-lang to commons-lang3 migration, size-based rotation for FileBasedEventLogger, and fixes for a swallowed exception and a heartbeat false-timeout. Representative of what the 2.8.x line looks like between security releases.

    View source ↗