[ https://issues.apache.org/jira/browse/PHOENIX-4729?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16469936#comment-16469936 ]
Josh Elser commented on PHOENIX-4729: ------------------------------------- Seems like you came to a conclusion already, [~jamestaylor]. Sorry for the delayed response. I think I didn't evaluate the "need" for Netty in 0.98 branches because I was solely looking at the problem from a known Netty-4 CVE that I wanted to "mitigate" (read-as prevent security scanners from complaining about). I'd venture a guess that Andrew just did the legwork to also say that 0.98 didn't need any Netty dependency and removed it as such :) > Remove unused netty dependencies in 0.98 branch > ----------------------------------------------- > > Key: PHOENIX-4729 > URL: https://issues.apache.org/jira/browse/PHOENIX-4729 > Project: Phoenix > Issue Type: Improvement > Reporter: James Taylor > Priority: Major > > Looks like netty dependencies were removed in branches other than 0.98 in > PHOENIX-4261. [~elserj] mentioned here[1] that it's not required for 0.98 > since we only depend on io.netty. [~apurtell] has a patch that removes the > dependencies from 0.98 as well. What's the right thing to do? > [1] > https://issues.apache.org/jira/browse/PHOENIX-4261?focusedCommentId=16188251&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-16188251 -- This message was sent by Atlassian JIRA (v7.6.3#76005)