Re: [DISCUSS] remove groovy from gremlin-driver
The issues with Groovy are clearly ongoing and this change does serve to generally reduce its footprint in TinkerPop. I am concerned that if we can't get off of Groovy 2.x we're eventually going to reach a point where we're blocked by the JDK (i.e. –illegal-access=permit goes away soon enough) or simply by some CVEs that aren't addressed properly. All that aside though, I think that this is a good chance to simplify the dependency tree on one of the most used modules in the set. Having Groovy in gremlin-driver for a feature that probably shouldn't have been built and likely isn't used feels a bit of a waste. On Thu, Jul 22, 2021 at 1:44 PM David Bechberger wrote: > Is reason for removing it is that this underlying groovy issue ( > https://issues.apache.org/jira/browse/GROOVY-9785) is blocking the > upgrade? > > > > On Thu, Jul 22, 2021 at 9:40 AM Stephen Mallette > wrote: > > > In 3.6.0 I think it worth taking the step to remove all groovy > dependencies > > from gremlin-driver. They were made in 3.5.0 and based on > there > > being no replies to this query on usage of the feature related to this > > dependency: > > > > https://groups.google.com/g/gremlin-users/c/vFPNwbHFl4w/m/U11fOLhWAgAJ > > > > I think that we can safely remove it. I believe that the impact here is > > only to GraphSON and Gryo. For Gryo, we've already deprecated it as a > > network protocol, but it was already an optional registration so if you > > needed it you could copy/paste the simple bit of code related to it and > > maintain it yourself. For GraphSON, it was made an standard part of the > > GremlinServerModule, but I think like, Gryo it would be easy enough to > > maintain your own custom version. > > > > Created this to track it: > > https://issues.apache.org/jira/browse/TINKERPOP-2593 > > > > Please let me know if there are any concerns. > > >
Re: [DISCUSS] remove groovy from gremlin-driver
Is reason for removing it is that this underlying groovy issue ( https://issues.apache.org/jira/browse/GROOVY-9785) is blocking the upgrade? On Thu, Jul 22, 2021 at 9:40 AM Stephen Mallette wrote: > In 3.6.0 I think it worth taking the step to remove all groovy dependencies > from gremlin-driver. They were made in 3.5.0 and based on there > being no replies to this query on usage of the feature related to this > dependency: > > https://groups.google.com/g/gremlin-users/c/vFPNwbHFl4w/m/U11fOLhWAgAJ > > I think that we can safely remove it. I believe that the impact here is > only to GraphSON and Gryo. For Gryo, we've already deprecated it as a > network protocol, but it was already an optional registration so if you > needed it you could copy/paste the simple bit of code related to it and > maintain it yourself. For GraphSON, it was made an standard part of the > GremlinServerModule, but I think like, Gryo it would be easy enough to > maintain your own custom version. > > Created this to track it: > https://issues.apache.org/jira/browse/TINKERPOP-2593 > > Please let me know if there are any concerns. >
[DISCUSS] remove groovy from gremlin-driver
In 3.6.0 I think it worth taking the step to remove all groovy dependencies from gremlin-driver. They were made in 3.5.0 and based on there being no replies to this query on usage of the feature related to this dependency: https://groups.google.com/g/gremlin-users/c/vFPNwbHFl4w/m/U11fOLhWAgAJ I think that we can safely remove it. I believe that the impact here is only to GraphSON and Gryo. For Gryo, we've already deprecated it as a network protocol, but it was already an optional registration so if you needed it you could copy/paste the simple bit of code related to it and maintain it yourself. For GraphSON, it was made an standard part of the GremlinServerModule, but I think like, Gryo it would be easy enough to maintain your own custom version. Created this to track it: https://issues.apache.org/jira/browse/TINKERPOP-2593 Please let me know if there are any concerns.
