[
https://issues.apache.org/jira/browse/CASSJAVA-62?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17907436#comment-17907436
]
Bret McGuire commented on CASSJAVA-62:
--------------------------------------
One additional observation that may be relevant to this issue: assuming we keep
a shaded Guava in some form we should look at changing the package name we
shade to. As of right now this is a "com.datastax" package... this should be
converted to an "org.apache" package at bare minimum. There was [some
conversation|https://github.com/apache/cassandra-java-driver/pull/1993#pullrequestreview-2512944530]
on this point in the PR for CASSJAVA-52.
Something similar should be done for Netty and _all_ of the shaded dependencies.
> Rethink Guava dependency in Java driver
> ---------------------------------------
>
> Key: CASSJAVA-62
> URL: https://issues.apache.org/jira/browse/CASSJAVA-62
> Project: Apache Cassandra Java driver
> Issue Type: Improvement
> Reporter: Lukasz Antoniak
> Assignee: Lukasz Antoniak
> Priority: Normal
>
> Java driver depends on two popular libraries - Guava and Netty. While Netty
> is treated as standard dependency (declared as dependency in core module and
> shaded in core-shaded), Guava is not. We create new shaded Guava artefact
> that is uploaded to Maven central.
> One idea of improvement is to apply the following dependency management
> strategy:
> 1. Publish core JAR with all standard dependencies. This way users that wish
> to temporarily upgrade Guava or Netty (for example due to CVE), will be able
> to do so.
> 2. Publish core-shaded JAR with all third-party libraries shaded.
> Described approach is cleaner, but would introduce a breaking change for
> people using OSGi and two modules - query builder and mapper - which depend
> on driver's shaded Guava packages. After making the change, users will need
> to introduce Guava bundle. Driver 4.18 is compatible with wide range of Guava
> versions - from 25 till most recent 33.
> PR: https://github.com/apache/cassandra-java-driver/pull/1983.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
