The Unidata THREDDS Development Team released updated versions of the THREDDS Data Server (TDS) and netCDF-Java/Common Data Model (CDM) library on June 17, 2020. In addition to feature enhancements, these releases contain a variety of updates to third-party libraries, including security updates. They also address a problem in previous versions that could lead to data returned by some NetcdfSubsetService (NCSS) requests being corrupted. While the circumstances under which the problem occurs are very specific (and rare), because the possibility of data corruption exists the development team strongly recommends these upgrades to anyone using netCDF-Java/CDM or TDS. TDS administrators who are not able to upgrade immediately should disable the NetcdfSubsetService until it is possible to do so.
Note that there are releases for both the 4.6.x branch of the TDS, which includes an associated version of the netCDF-Java library, and for version 5.x, for which the TDS and netCDF-Java code bases are separate. This release includes version 5.3.3 of the netCDF-Java library (supported release) and version 5.0.0-beta8 of the TDS (beta-test release).
Background
The problem addressed by these releases affects responses returned by the NetcdfSubsetService (NCSS) of the TDS when two very similar requests arrive simultaneously. Specifically:
- The two NCSS requests must be either grid subsets, grid-as-point subsets, or NCSS subsets on point collections. Both requests must be the same type.
- Both requests must be asking for netCDF3/netCDF4 files in return. (The problem does not occur with other return types, like xml or csv).
- The requests must be received nearly simultaneously, such that the associated temporary files are requested within the same millisecond.
Those interested in additional technical information can read the detailed description contained in DiskCache2 Issue in netCDF-Java Library in the Developers@Unidata blog.
Getting this Release
Users of the current supported version of the TDS are encouraged to upgrade to version 4.6.15, which includes an appropriate version of the netCDF-Java library. The v4.6.x maintenance line will continue to reside at https://github.com/Unidata/thredds. The Unidata managed TDS Docker container for this release can be found at https://github.com/Unidata/thredds-docker.
Users of the netCDF-Java library are encouraged to upgrade to version 5.3.3 of netCDF-Java, located at https://github.com/Unidata/netcdf-java.
Users of the beta-test version of the TDS are encouraged to upgrade to version 5.0.0-beta8, available at https://www.unidata.ucar.edu/downloads/tds/, (Docker container at https://github.com/Unidata/thredds-docker) alongside the upgrade to netCDF-Java version 5.3.3.
