Hello everyone,
Posting the thread update. We have merged the issue into trunk and
5.0, so basically there should be no problems and backwards
compatibility issues. I'd like to thank all of you for your
cooperation and I'm happy to see this update will be in use soon.
https://issues.apache.org/jira/browse/CASSANDRA-14667
On Thu, 27 Jul 2023 at 16:41, Josh McKenzie wrote:
>
> +1 to the change pre 5.0.
>
> Any committers have bandwidth to review
> https://issues.apache.org/jira/projects/CASSANDRA/issues/CASSANDRA-14667?
>
> PR can be found here: https://github.com/apache/cassandra/pull/2238/files
>
> On Thu, Jul 27, 2023, at 7:59 AM, Maxim Muzafarov wrote:
>
> Bump this topic up for visibility as the code freeze is coming soon.
>
> This seems like a good change to include in 5.0 as this kind of
> library upgrade is more natural when the major version changes. It is
> still possible to postpone it to 6.0, but the main concern here is
> that the current version of dropwizard metrics library is obsolete and
> no longer supported and it is better to avoid emergencies that could
> arise (like the panic with log4j library upgrade some time ago).
>
> The change itself is straightforward and deserves more eyes on it from
> my point of view.
>
> On Fri, 21 Jul 2023 at 14:51, Maxim Muzafarov wrote:
> >
> > Hello everyone,
> >
> > It still needs a pair of eyes to push it forward.
> >
> >
> > I came across another good thing that might help us to overcome the
> > difficulties with the dropwizard metrics dependency upgrade. The
> > change relates to the driver itself and reuses the same approach that
> > was used to deal with the driver's netty dependencies. We need to
> > shade the dropwizard metrics classes and no longer rely on the
> > cassandra classpath at least for the 3.x version of the java driver,
> > and make the next 3.11.4 release of the java driver accordingly.
> >
> > The changes for the driver are here:
> > https://github.com/datastax/java-driver/pull/1685
> >
> > This will give us (and users as well) the confidence to move forward
> > with this change to 5.x alongside the 3.11 version of the driver
> > usage. Looking forward to your thoughts.
> >
> > Changes for the Cassandra part are here:
> > https://github.com/apache/cassandra/pull/2238/files
> >
> > On Mon, 3 Jul 2023 at 15:15, Maxim Muzafarov wrote:
> > >
> > > I'd like to mention the approach we took here: to untangle the driver
> > > update in tests with the dropwizard library version (cassandra-driver
> > > 3.11 requires the "old" JMXReporter classes in the classpath) we have
> > > copied the classes into the tests themselves, as it is allowed by the
> > > Apache License 2.0. This way we can update the metrics library itself
> > > and then update the driver used in the tests afterwards.
> > >
> > > If there are no objections, we need another committer to take a look
> > > at these changes:
> > > https://issues.apache.org/jira/browse/CASSANDRA-14667
> > > https://github.com/apache/cassandra/pull/2238/files
> > >
> > > Thanks in advance for your help!
> > >
> > > On Wed, 28 Jun 2023 at 16:04, Bowen Song via dev
> > > wrote:
> > > >
> > > > IMHO, anyone upgrading software between major versions should expect to
> > > > see breaking changes. Introducing breaking or major changes is the whole
> > > > point of bumping major version numbers.
> > > >
> > > > Since the library upgrade need to happen sooner or later, I don't see
> > > > any reason why it should not happen in the 5.0 release.
> > > >
> > > >
> > > > On 27/06/2023 19:21, Maxim Muzafarov wrote:
> > > > > Hello everyone,
> > > > >
> > > > >
> > > > > We use the Dropwizard Metrics 3.1.5 library, which provides a basic
> > > > > set of classes to easily expose Cassandra internals to a user through
> > > > > various interfaces (the most common being JMX). We want to upgrade
> > > > > this library version in the next major release 5.0 up to the latest
> > > > > stable 4.2.19 for the following reasons:
> > > > > - the 3.x (and 4.0.x) Dropwizard Metrics library is no longer
> > > > > supported, which means that if we face a critical CVE, we'll still
> > > > > need to upgrade, so it's better to do it sooner and more calmly;
> > > > > - as of 4.2.5 the library supports jdk11, jdk17, so we will be in-sync
> > > > > [1] as well as having some of the compatibility fixes mentioned in the
> > > > > related JIRA [2];
> > > > > - there have been a few user-related requests [3][4] whose
> > > > > applications collide with the old version of the library, we want to
> > > > > help them;
> > > > >
> > > > >
> > > > > The problem
> > > > >
> > > > > The problem with simply upgrading is that the JmxReporter class of the
> > > > > library has moved from the com.codahale.metrics package in the 3.x
> > > > > release to the com.codahale.metrics.jmx package in the 4.x release.
> > > > > This is a problem for applications/tools that rely on the cassandra
> > > > > classpath (lib/jars) as after the upgrade they m
