v3.3.9 changes

Author: gockle

CHANGELOG.md

@@ -6,11 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
-## [3.3.9] - 2025-06-05
+## [3.3.9] - 2025-06-09
 
 ### Security
 
-- Revert Java JDK version from 21 to 11. To match Taurus image version.
+- Update Jmeter to 5.6.3 to resolve issue with groovy scripts.
+- Update Jmeter-plugin-manager to 1.11 to resolve [CVE](https://nvd.nist.gov/vuln/detail/CVE-2025-48734)
 - Remove setuptools older distributions in the ECR Image.
 
 ## [3.3.8] - 2025-05-22
@@ -35,8 +36,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changes
 
-- Updating lambda runtimes to use node-20.
 - Updated Dockerfile results in an [image of size 424 MB instead of the earlier 2.2 GB](https://gallery.ecr.aws/aws-solutions/distributed-load-testing-on-aws-load-tester), this results in improved test start times, depending on the task count, a 500 task count tests starts 40% faster than the previous version of the solution.
+- Updating lambda runtimes to use node-20
 
 ## [3.3.5] - 2025-03-17
 

deployment/ecr/distributed-load-testing-on-aws-load-tester/.bzt-rc

@@ -0,0 +1,31 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+modules:
+  jmeter:
+    path: ~/.bzt/jmeter-taurus/{version}/bin/jmeter
+    download-link: https://archive.apache.org/dist/jmeter/binaries/apache-jmeter-{version}.zip
+    version: 5.6.3
+    force-ctg: true
+    detect-plugins: true
+    fix-jars: true
+    plugins:
+    - jpgc-json
+    - jmeter-ftp
+    - jpgc-casutg
+    - jpgc-dummy
+    - jpgc-ffw
+    - jpgc-fifo
+    - jpgc-functions
+    - jpgc-perfmon
+    - jpgc-prmctl
+    - jpgc-tst
+    - jpgc-udp
+    - bzm-http2
+    - bzm-random-csv
+    plugins-manager:
+      download-link: https://search.maven.org/remotecontent?filepath=kg/apc/jmeter-plugins-manager/{version}/jmeter-plugins-manager-{version}.jar
+      version: '1.11'
+    command-runner:
+      download-link: https://search.maven.org/remotecontent?filepath=kg/apc/cmdrunner/{version}/cmdrunner-{version}.jar
+      version: 2.3

deployment/ecr/distributed-load-testing-on-aws-load-tester/Dockerfile

@@ -8,8 +8,10 @@ ENV PIP_INSTALL="pip3.11 install --no-cache-dir"
 
 
 # install bzt
-RUN $PIP_INSTALL --upgrade bzt awscli setuptools==78.1.1 h11 && \
+RUN $PIP_INSTALL --upgrade bzt awscli setuptools==78.1.1 h11 urllib3==2.2.2 && \
     $PIP_INSTALL --upgrade bzt
+COPY ./.bzt-rc /root/.bzt-rc
+RUN chmod 755 /root/.bzt-rc
 
 # install bzt tools
 RUN bzt -install-tools -o modules.install-checker.exclude=selenium,gatling,tsung,siege,ab,k6,external-results-loader,locust,junit,testng,rspec,mocha,nunit,xunit,wdio,robot,newman
@@ -27,7 +29,8 @@ RUN python3.11 /bzt-configs/jar_updater.py
 
 # Remove jar files from /tmp
 RUN rm -rf /tmp/jmeter-plugins-manager-1* && \
-    rm -rf /usr/local/lib/python3.11/site-packages/setuptools-65.5.0.dist-info
+    rm -rf /usr/local/lib/python3.11/site-packages/setuptools-65.5.0.dist-info && \
+    rm -rf /usr/local/lib/python3.11/site-packages/urllib3-1.26.17.dist-info
 
 # Add settings file to capture the output logs from bzt cli
 RUN mkdir -p /etc/bzt.d && echo '{"settings": {"artifacts-dir": "/tmp/artifacts"}}' > /etc/bzt.d/90-artifacts-dir.json

deployment/ecr/distributed-load-testing-on-aws-load-tester/jar_updater.py

@@ -12,7 +12,7 @@
 jar_updater.py updates following jar files to address CVEs on the taurus image. this is not DLT application code. 
 the script may be removed once taurus updates the libraries on the image.
 Affected Jmeter jars:
-    * json-smart v2.4.8 will be replaced with v2.4.10
+    * json-smart v2.5.0 will be replaced with v2.5.2
     * neo4j-java-driver v4.12.0 will be replaced with v5.14.0
     * batik-script v1.14 will be replaced with v1.17
     * batik-bridge v1.14 will be replaced with v1.17
@@ -29,7 +29,7 @@
 # component name and download link in https://repo1.maven.org/maven2/
 # These are Components with regards to JMETER
 JMETER_COMPONENTS = {
-    "json-smart": "net/minidev/json-smart/2.4.10/json-smart-2.4.10.jar",
+    "json-smart": "net/minidev/json-smart/2.5.2/json-smart-2.5.2.jar",
     "neo4j-java-driver": "org/neo4j/driver/neo4j-java-driver/5.14.0/neo4j-java-driver-5.14.0.jar",
     "batik-script": "org/apache/xmlgraphics/batik-script/1.17/batik-script-1.17.jar",
     "batik-bridge": "org/apache/xmlgraphics/batik-bridge/1.17/batik-bridge-1.17.jar",
@@ -39,10 +39,14 @@
     "tika-core": "org/apache/tika/tika-core/1.28.4/tika-core-1.28.4.jar",
     "json-path": "com/jayway/jsonpath/json-path/2.9.0/json-path-2.9.0.jar",
     "dnsjava": "dnsjava/dnsjava/3.6.1/dnsjava-3.6.1.jar",
-    "xstream":"com/thoughtworks/xstream/xstream/1.4.21/xstream-1.4.21.jar"
+    "xstream":"com/thoughtworks/xstream/xstream/1.4.21/xstream-1.4.21.jar",
+    "http2-hpack": "org/eclipse/jetty/http2/http2-hpack/11.0.16/http2-hpack-11.0.16.jar",
+    "jetty-http": "org/eclipse/jetty/jetty-http/12.0.12/jetty-http-12.0.12.jar",
+    "http2-common": "org/eclipse/jetty/http2/http2-common/11.0.20/http2-common-11.0.20.jar",
+    "kotlin-stdlib": "org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar",
 }
-JMETER_VERSION = "5.5"
-JMETER_PLUGINS_MANAGER_VERSION = "1.10"
+JMETER_VERSION = "5.6.3"
+JMETER_PLUGINS_MANAGER_VERSION = "1.11"
 CMD_RUNNER_VERSION = "2.3"
 # To add other platform, and what to update, add affected components and version HERE