[
https://issues.apache.org/jira/browse/FLINK-40617?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Purushottam Sinha updated FLINK-40617:
--------------------------------------
Description:
Several third-party dependency versions pinned in the root pom.xml are updated,
and dependencyManagement entries that no longer serve a purpose are pruned.
Bumped:
- jackson-bom 2.21.3 -> 2.22.4 (compile-scope; not bundled, reaches users
transitively through flink-connector-kafka). 2.21.3 is affected by 19 Jackson
advisories, eight of them high severity; 2.22.4 clears all of them.
- log4j 2.25.5 -> 2.26.1, avro 1.12.0 -> 1.12.2, docker-java-api 3.5.2 ->
3.7.1, guava 33.4.8-jre -> 33.7.2-jre, snakeyaml 2.4 -> 2.7 (test-scope).
Dropped:
- commons-cli, javassist and objenesis: every reactor path already resolves a
single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing. Removed
the property and the dependencyManagement entry.
- commons-codec: provided transitively through flink-dist's commons-compress,
and every reactor path already resolves it to 1.17.1, so the pin only raised a
version nothing asked for. Removed the property and the dependencyManagement
entry.
- the mockito and powermock version properties: both groups are banned by
enforce-banned-deps, so nothing can use them.
- the duplicate snakeyaml.version property.
Left at their prior pins (kept for convergence, not raised):
- commons-io (2.19.0) and commons-compress (1.27.1) are supplied by flink-dist
as provided dependencies; the pins only reconcile transitive convergence, so
bumping them changes nothing that runs on a cluster.
- snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
commons-lang3 stays at 3.18.0 and moves to test-scope: its one production call
in DynamicKafkaSourceBuilder is replaced with Flink's
StringUtils.generateRandomAlphanumericString, keeping it off every user's
classpath.
was:
Several third-party dependency versions pinned in the root pom.xml are updated,
and dependencyManagement entries that no longer serve a purpose are pruned.
Bumped:
- jackson-bom 2.21.3 -> 2.22.4 (compile-scope, ships in
flink-connector-kafka.jar). 2.21.3 is affected by 19 Jackson advisories, eight
of them high severity; 2.22.4 clears all of them.
- log4j 2.25.5 -> 2.26.1, avro 1.12.0 -> 1.12.2, docker-java-api 3.5.2 ->
3.7.1, guava 33.4.8-jre -> 33.7.2-jre, snakeyaml 2.4 -> 2.7 (test-scope).
Dropped:
- commons-cli, javassist and objenesis: every reactor path already resolves a
single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing. Removed
the property and the dependencyManagement entry.
- commons-codec: provided transitively through flink-dist's commons-compress,
and every reactor path already resolves it to 1.17.1, so the pin only raised a
version nothing asked for. Removed the property and the dependencyManagement
entry.
- the mockito and powermock version properties: both groups are banned by
enforce-banned-deps, so nothing can use them.
- the duplicate snakeyaml.version property.
Left at their prior pins (kept for convergence, not raised):
- commons-io (2.19.0) and commons-compress (1.27.1) are supplied by flink-dist
as provided dependencies; the pins only reconcile transitive convergence, so
bumping them changes nothing that runs on a cluster.
- snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
commons-lang3 stays at 3.18.0 and moves to test-scope: its one production call
in DynamicKafkaSourceBuilder is replaced with Flink's
StringUtils.generateRandomAlphanumericString, keeping it off every user's
classpath.
> Connectors/Kafka: Prune and bump dependency versions in the root pom
> --------------------------------------------------------------------
>
> Key: FLINK-40617
> URL: https://issues.apache.org/jira/browse/FLINK-40617
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Kafka
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> Several third-party dependency versions pinned in the root pom.xml are
> updated, and dependencyManagement entries that no longer serve a purpose are
> pruned.
> Bumped:
> - jackson-bom 2.21.3 -> 2.22.4 (compile-scope; not bundled, reaches users
> transitively through flink-connector-kafka). 2.21.3 is affected by 19 Jackson
> advisories, eight of them high severity; 2.22.4 clears all of them.
> - log4j 2.25.5 -> 2.26.1, avro 1.12.0 -> 1.12.2, docker-java-api 3.5.2 ->
> 3.7.1, guava 33.4.8-jre -> 33.7.2-jre, snakeyaml 2.4 -> 2.7 (test-scope).
> Dropped:
> - commons-cli, javassist and objenesis: every reactor path already resolves a
> single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing.
> Removed the property and the dependencyManagement entry.
> - commons-codec: provided transitively through flink-dist's commons-compress,
> and every reactor path already resolves it to 1.17.1, so the pin only raised
> a version nothing asked for. Removed the property and the
> dependencyManagement entry.
> - the mockito and powermock version properties: both groups are banned by
> enforce-banned-deps, so nothing can use them.
> - the duplicate snakeyaml.version property.
> Left at their prior pins (kept for convergence, not raised):
> - commons-io (2.19.0) and commons-compress (1.27.1) are supplied by
> flink-dist as provided dependencies; the pins only reconcile transitive
> convergence, so bumping them changes nothing that runs on a cluster.
> - snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
> commons-lang3 stays at 3.18.0 and moves to test-scope: its one production
> call in DynamicKafkaSourceBuilder is replaced with Flink's
> StringUtils.generateRandomAlphanumericString, keeping it off every user's
> classpath.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
