FrankChen021 commented on PR #20657: URL: https://github.com/apache/druid/pull/20657#issuecomment-6316596048
Kafka 4.4.0 brought a transitive requirement for zstd-jni 1.5.7-17, while Druid was managing 1.5.7-11. That mismatch triggered Maven RequireUpperBoundDeps/dependency-convergence CI failures. Upgrading the zstd-jni here makes sense. As we discussed before that upgrading the zstd-jni will drop the support of old zstd frames, which has already been call out as deprecated in druid 38. on druid 40, we can formally remove the support those old frames. And I also checked that the kafka 4.4.0 can work with zstd-jni, so anyone who is still using the old frames can use the old jar in their release to get those old frames supported. @amaechler I remember that you added a rule to suppress the zstd-jni in the dependabot CI, we can remove it after this one is merged @kfaraz also added a CVE suppress rule for this lib, which can also be removed after this one is merged I have not approved this one because once it's APPROVED, it will be merged automatically. If there's no objections, let's approve this one @clintropolis @capistrant -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
