[
https://issues.apache.org/jira/browse/PHOENIX-4729?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16469936#comment-16469936
]
Josh Elser commented on PHOENIX-4729:
-------------------------------------
Seems like you came to a conclusion already, [~jamestaylor]. Sorry for the
delayed response.
I think I didn't evaluate the "need" for Netty in 0.98 branches because I was
solely looking at the problem from a known Netty-4 CVE that I wanted to
"mitigate" (read-as prevent security scanners from complaining about).
I'd venture a guess that Andrew just did the legwork to also say that 0.98
didn't need any Netty dependency and removed it as such :)
> Remove unused netty dependencies in 0.98 branch
> -----------------------------------------------
>
> Key: PHOENIX-4729
> URL: https://issues.apache.org/jira/browse/PHOENIX-4729
> Project: Phoenix
> Issue Type: Improvement
> Reporter: James Taylor
> Priority: Major
>
> Looks like netty dependencies were removed in branches other than 0.98 in
> PHOENIX-4261. [~elserj] mentioned here[1] that it's not required for 0.98
> since we only depend on io.netty. [~apurtell] has a patch that removes the
> dependencies from 0.98 as well. What's the right thing to do?
> [1]
> https://issues.apache.org/jira/browse/PHOENIX-4261?focusedCommentId=16188251&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-16188251
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
