Hi all, I'd like to bring KAFKA-21056 <https://issues.apache.org/jira/browse/KAFKA-21056> here for broader input. It proposes replacing gradle/dependencies.gradle with a Gradle version catalog and enabling Dependabot for Gradle dependencies. I'm not sure it needs a KIP; if it does, I can draft one.
Motivation - Upgrades are manual. The ben-manes versions plugin and OWASP dependency-check are configured but don't run in CI. The only automated CVE check is docker_scan.yml, which scans images after release. dependencies.gradle has had 59 commits so far this year. - Dependabot, Renovate and IntelliJ understand version catalogs but don't reliably parse our ext map. A catalog would also centralise most plugin versions, which are currently hardcoded in build.gradle. - Faster CVE fixes for the libraries shipped like jackson, jetty, log4j, etc. Plan - Migrate to libs.versions.toml, including plugin versions. - Add a "gradle" entry to .github/dependabot.yml so Dependabot opens PRs, which can be reviewed manually. - Group PRs weekly or monthly, and ignore or pin specific libraries (ex: slf4j, scala). - Target trunk, and optionally release branches. - Every upgrade of a shipped library also needs a LICENSE-binary update (verify_license.py fails CI otherwise). That could likely be automated too. Dowsides of this approach - PRs to be reviewed - sometimes the bumps can be unsafe like slf4j Looking forward to your feedback. Thanks, Murali
