[
https://issues.apache.org/jira/browse/FLINK-40617?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Martijn Visser updated FLINK-40617:
-----------------------------------
Release Note: The connector's Jackson dependency (compile scope, not
bundled) is upgraded from 2.21.3 to 2.22.4 to address published security
advisories. Applications that pin other Jackson 2.21 modules may need to align
them to 2.22."
> Connectors/Kafka: Prune and bump dependency versions in the root pom
> --------------------------------------------------------------------
>
> Key: FLINK-40617
> URL: https://issues.apache.org/jira/browse/FLINK-40617
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Kafka
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> Several third-party dependency versions pinned in the root pom.xml are
> updated, and dependencyManagement entries that no longer serve a purpose are
> pruned.
> Bumped:
> - jackson-bom 2.21.3 -> 2.22.4 (compile-scope; not bundled, reaches users
> transitively through flink-connector-kafka). 2.21.3 is affected by 19 Jackson
> advisories, eight of them high severity; 2.22.4 clears all of them.
> - log4j 2.25.5 -> 2.26.1, avro 1.12.0 -> 1.12.2, docker-java-api 3.5.2 ->
> 3.7.1, guava 33.4.8-jre -> 33.7.2-jre, snakeyaml 2.4 -> 2.7 (test-scope).
> Dropped:
> - commons-cli, javassist and objenesis: every reactor path already resolves a
> single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing.
> Removed the property and the dependencyManagement entry.
> - commons-codec: provided transitively through flink-dist's commons-compress,
> and every reactor path already resolves it to 1.17.1, so the pin only raised
> a version nothing asked for. Removed the property and the
> dependencyManagement entry.
> - the mockito and powermock version properties: both groups are banned by
> enforce-banned-deps, so nothing can use them.
> - the duplicate snakeyaml.version property.
> Left at their prior pins (kept for convergence, not raised):
> - commons-io (2.19.0) and commons-compress (1.27.1) are supplied by
> flink-dist as provided dependencies; the pins only reconcile transitive
> convergence, so bumping them changes nothing that runs on a cluster.
> - snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
> commons-lang3 stays at 3.18.0 and moves to test-scope: its one production
> call in DynamicKafkaSourceBuilder is replaced with Flink's
> StringUtils.generateRandomAlphanumericString, keeping it off every user's
> classpath.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
