Ralph Ursprung created KAFKA-21055:
--------------------------------------
Summary: upgrade from jackson 2.x to jackson 3.x
Key: KAFKA-21055
URL: https://issues.apache.org/jira/browse/KAFKA-21055
Project: Kafka
Issue Type: Improvement
Reporter: Ralph Ursprung
kafka currently uses jackson 2.x, see
[{{dependencies.gradle}}|https://github.com/apache/kafka/blob/81e8ebc9f1648d7dfdfd0e8051a6dd39431f068a/gradle/dependencies.gradle#L65]
jackson 3.x has now been out for a while and and the clock is counting down for
jackson 2.x (2.21.x is an LTS with ~2 years of support acc. to their documents).
more information can be found in their [migration
guide|https://github.com/FasterXML/jackson/blob/main/jackson3/MIGRATING_TO_JACKSON_3.md]
there are several reasons for migrating:
* upgrade to the current major release of jackson to continue receiving
support/updates long-term
* hopefully fewer CVEs coming from jackson (i don't have any numbers for it,
but i _feel_ like i've seen fewer CVEs issued for jackson 3.x than jackson 2.x?)
* no leakage of jackson 2.x into other applications consuming kafka libraries
the last point is the one which causes me to raise this issue: spring boot 4.1
upgraded from jackson 2.x to 3.x, however when using kafka (e.g. through the SB
kafka starter) the application now contains both jackson 2.x and jackson 3.x.
this means i have more dependencies rather than fewer (and more dependency
updates to deal with).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
