[
https://issues.apache.org/jira/browse/CASSANDRA-19654?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17849228#comment-17849228
]
Stefan Miklosovic edited comment on CASSANDRA-19654 at 5/24/24 9:25 AM:
------------------------------------------------------------------------
I am not sure if we are going to bump the versions in a patch release. We
should carefully evaluate what impact it has because people bumping a patch
release in their integrations do not expect that their dependency tree would be
changed suddenly and substantially. cc [~brandon.williams]
was (Author: smiklosovic):
I am not sure if we are going to bump the versions in a patch releases. We
should carefully evaluate what impact it has because people bumping a patch
release in their integrations do not expect that their dependency tree would be
changed suddenly and substantially. cc [~brandon.williams]
> Update bundled Cassandra cassandra-driver-core dependency
> ---------------------------------------------------------
>
> Key: CASSANDRA-19654
> URL: https://issues.apache.org/jira/browse/CASSANDRA-19654
> Project: Cassandra
> Issue Type: Task
> Components: Dependencies
> Reporter: Jackson Fleming
> Priority: Normal
>
> There's a dependency in Cassandra project on an old version of the Java
> driver cassandra-driver-core - 3.11.0 in the 4.0 and later releases of
> Cassandra
>
> (For example on the 4.1 branch
> [https://github.com/apache/cassandra/blob/cassandra-4.1/build.xml#L691)]
>
> It appears that this dependency may have some security vulnerabilities in
> transitive dependencies.
> But also this is a very old version of the driver, ideally it would be
> aligned to a newer version, I would suggest either 3.11.5 which is the latest
> in that line of driver versions
> [https://mvnrepository.com/artifact/com.datastax.cassandra/cassandra-driver-core|https://mvnrepository.com/artifact/com.datastax.cassandra/cassandra-driver-core)]
> or this gets updated to the latest 4.x driver (as of writing that's 4.18.1 in
> [https://mvnrepository.com/artifact/org.apache.cassandra/java-driver-core] )
> but this seems like a larger undertaking.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
