lhotari commented on issue #24996: URL: https://github.com/apache/pulsar/issues/24996#issuecomment-3543038281
For software supply chain security reasons, I wouldn't like to depend on projects that aren't well known. In Pulsar, there's already https://github.com/apache/pulsar/blob/master/pulsar-client-dependencies-minimized/pom.xml which handles minimizing `fastutil` classes to the ones that are used. We don't currently publish this artifact to maven central since it wasn't designed for external use. If you are using a maven build, you could copy https://github.com/apache/pulsar/blob/master/pulsar-client-dependencies-minimized/pom.xml to your project to build the minimized version of fastutil for pulsar-client-original. You could then exclude the fastutil dependency from pulsar-client-original in your usage and add the minimized version of fastutil as a dependency instead. Is this a feasible solution for your use case? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
