apache/dubbo
The java implementation of Apache Dubbo. An RPC and microservice framework.
How dubbo is put together
Apache Dubbo (branch 3.3, version 3.3.7-SNAPSHOT) is a Java RPC and microservices framework built as a large Maven multi-module project targeting JDK 8 through 25. It follows a layered architecture: dubbo-common provides core utilities and an SPI extension mechanism; dubbo-remoting handles transports (Netty4, HTTP/1.2, HTTP/3, WebSocket); dubbo-rpc implements protocols (Triple/gRPC-compatible, legacy Dubbo TCP, injvm); dubbo-cluster provides routing/load-balancing/directory logic; dubbo-registry integrates discovery backends (Zookeeper/Curator5, Nacos, multicast); and dubbo-config plus the dubbo-spring-boot-project wire everything into Spring and Spring Boot applications. Data flows from consumer-side proxies through cluster/routing to registered provider addresses discovered from registries, with serialization (hessian2, fastjson2), metrics/tracing (Micrometer, Prometheus, OTLP), and plugins for QoS, auth, TLS security, REST, and native-image support.
Languages
Frameworks
Datastores
Infrastructure
Major components
dubbo-common
Core utilities, URL model, SPI extension loading (@SPI/@Extension), ScopeModel bean factories, serialization security managers, and CertManager.
dubbo-remoting
Network transport abstraction with Netty4, HTTP/1.2, HTTP/3, WebSocket, and Zookeeper-Curator5 client implementations.
dubbo-rpc
RPC protocol layer including the API contract, the legacy Dubbo TCP protocol, injvm local calls, and the Triple (gRPC-compatible) protocol with proto definitions.
dubbo-cluster
Consumer-side clustering: Directory, routing, load balancing, address notification (AddressListener), and fault tolerance.
dubbo-registry
Service registration/discovery integrations for Nacos, Zookeeper, multicast, and multiple aggregated registries.
dubbo-config (+ dubbo-config-api/spring/spring6)
Configuration assembly API and Spring integration including XML schema (dubbo.xsd), namespace handlers, and JDK-17-gated Spring 6 module.
dubbo-spring-boot-project
Spring Boot autoconfiguration, starters (core, nacos, seata, sentinel, observability, tracing), and actuator endpoints.
dubbo-plugin
Optional capabilities: QoS ops endpoints, auth, TLS/security (ca.proto), reactive/Mutiny, REST (jaxrs/spring/openapi), Triple servlet/websocket adapters, native-image, filters (cache/validation), MCP.
A maintenance-focused week with two dependency upgrades, a test stability fix, and a streamlined code review process.
4 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A maintenance-focused week with two dependency upgrades, a test stability fix, and a streamlined code review process.
Week of 2026-08-17
A single targeted fix improved how Dubbo's high-performance communication protocol hands off incoming gRPC messages.
Week of 2026-07-27
One routing fix ensured requests are only sent to servers that are actually available.
Week of 2026-07-20
A small but important fix made sure rejected streaming connections are properly closed instead of left hanging.
The last few weeks of activity on Apache Dubbo focused on reliability fixes in its communication and routing layers, with a quieter stretch in late July followed by a busier week of dependency updates and test hardening. Key work included fixing how streaming data is decoded and handed off between components, correcting a routing bug that could pick the wrong servers, and keeping the project's software dependencies up to date.
Week by week
2026-08-24A maintenance-focused week with two dependency upgrades, a test stability fix, and a streamlined code review process.latest4 changes
Chore
Updated Spring web library
Bumped the Spring web framework to a newer version to pick up the latest improvements and security patches.
Chore
Updated Spring Security authorization server
Upgraded the Spring Security OAuth2 authorization server component to stay current with upstream releases.
Chore
Made a configuration test more reliable
Fixed the SpringBootConfigPropsTest so that leftover settings from other tests can no longer cause it to fail unexpectedly.
Chore
Simplified the review approval process
Reduced the number of required approving reviews for changes from two to one, speeding up how quickly contributions can be merged.
2026-08-17A single targeted fix improved how Dubbo's high-performance communication protocol hands off incoming gRPC messages.1 change
Fix
Fixed Triple protocol's gRPC message handoff
Corrected the way the Triple communication layer passes decoded gRPC messages along internally, preventing messages from being mishandled during transfer.
2026-07-27One routing fix ensured requests are only sent to servers that are actually available.1 change
Fix
Corrected state-based server routing
Fixed a bug where the router could incorrectly include unavailable servers by not properly filtering the tail end of the server list.
2026-07-20A small but important fix made sure rejected streaming connections are properly closed instead of left hanging.1 change
Fix
Closed rejected streaming inputs
When an incoming stream is refused, the system now properly closes it rather than leaving resources tied up.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
Any Dubbo provider RPC endpoint (Triple or legacy dubbo protocol) in an application that has the dubbo-plugin/dubbo-spring-security module on its classpath. The provider-side filter ContextHolderAuthenticationResolverFilter (Activate group=PROVIDER, order=-10000) runs automatically on every invocation.
An unauthenticated network caller fully forges any identity and role inside the provider JVM, bypassing all Spring Security authorization decisions made against the propagated Authentication.
Fix: Do not trust the client-supplied security context. Either drop ContextHolderAuthenticationResolverFilter's use of raw attachments, or protect the attachment with an HMAC computed from a credential the client proves at the transport layer (e.g. bind the context to the TLS peer or an authenticated Dubbo session) and verify it before calling setAuthentication. At minimum, providers must be able to disable context propagation and reject requests carrying the attachment when propagation is not explicitly enabled.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required