This is an automated email from the ASF dual-hosted git repository.
MartijnVisser pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/flink-connector-kafka.git
The following commit(s) were added to refs/heads/main by this push:
new 2d8ea909 [FLINK-40617][build] Prune and bump dependency versions in
the root pom
2d8ea909 is described below
commit 2d8ea909127312d6b6404e7f9f18979faf9a9ed5
Author: Purushottam Sinha <[email protected]>
AuthorDate: Thu Sep 24 01:52:30 2026 +0530
[FLINK-40617][build] Prune and bump dependency versions in the root pom
Bumps dependencies that reach users through the connector's compile
scope or affect the test JVM, and prunes dependencyManagement entries
that only raised a transitively supplied version without reconciling a
convergence conflict.
Bumped:
- jackson-bom 2.21.3 -> 2.22.4 (compile; not bundled, reaches users
transitively through flink-connector-kafka).
2.21.3 is affected by 19 Jackson advisories, eight of them high
severity; 2.22.4 clears all of them.
- log4j 2.25.5 -> 2.26.1, avro 1.12.0 -> 1.12.2, docker-java-api 3.5.2 ->
3.7.1, guava 33.4.8-jre -> 33.7.2-jre, snakeyaml 2.4 -> 2.7 (all test)
Dropped:
- commons-cli, javassist and objenesis: every reactor path already resolves
a single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing.
- commons-codec: provided transitively through flink-dist's commons-compress
and every reactor path already resolves it to 1.17.1, so the pin only
raised a version nothing asked for.
- the mockito and powermock version properties: both groups are banned by
enforce-banned-deps, so nothing can use them.
- the duplicate snakeyaml.version property.
Left at their prior pins (kept for convergence, not raised):
- commons-io (2.19.0) and commons-compress (1.27.1) are supplied by
flink-dist as provided dependencies; the pins only reconcile transitive
convergence, so bumping them changes nothing that runs on a cluster.
- snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
commons-lang3 stays at 3.18.0 and moves to test scope: its one production
call in DynamicKafkaSourceBuilder is replaced with Flink's
StringUtils.generateRandomAlphanumericString, keeping it off every user's
classpath. flink-core already brings 3.18.0 transitively, so there was no
reason to raise the pin.
Generated-by: Claude Code (claude-opus-4-8, claude-opus-5-5)
---
flink-connector-kafka/pom.xml | 11 +++---
.../dynamic/source/DynamicKafkaSourceBuilder.java | 6 ++-
pom.xml | 44 +++-------------------
3 files changed, 16 insertions(+), 45 deletions(-)
diff --git a/flink-connector-kafka/pom.xml b/flink-connector-kafka/pom.xml
index 088e950d..21a7dc47 100644
--- a/flink-connector-kafka/pom.xml
+++ b/flink-connector-kafka/pom.xml
@@ -106,11 +106,6 @@ under the License.
<scope>provided</scope>
</dependency>
- <dependency>
- <groupId>org.apache.commons</groupId>
- <artifactId>commons-lang3</artifactId>
- </dependency>
-
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
@@ -164,6 +159,12 @@ under the License.
<!-- Tests -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <scope>test</scope>
+ </dependency>
+
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-clients</artifactId>
diff --git
a/flink-connector-kafka/src/main/java/org/apache/flink/connector/kafka/dynamic/source/DynamicKafkaSourceBuilder.java
b/flink-connector-kafka/src/main/java/org/apache/flink/connector/kafka/dynamic/source/DynamicKafkaSourceBuilder.java
index 2bea803f..4557226f 100644
---
a/flink-connector-kafka/src/main/java/org/apache/flink/connector/kafka/dynamic/source/DynamicKafkaSourceBuilder.java
+++
b/flink-connector-kafka/src/main/java/org/apache/flink/connector/kafka/dynamic/source/DynamicKafkaSourceBuilder.java
@@ -30,8 +30,8 @@ import
org.apache.flink.connector.kafka.source.enumerator.initializer.NoStopping
import
org.apache.flink.connector.kafka.source.enumerator.initializer.OffsetsInitializer;
import
org.apache.flink.connector.kafka.source.reader.deserializer.KafkaRecordDeserializationSchema;
import org.apache.flink.util.Preconditions;
+import org.apache.flink.util.StringUtils;
-import org.apache.commons.lang3.RandomStringUtils;
import org.apache.kafka.clients.CommonClientConfigs;
import org.apache.kafka.clients.consumer.ConsumerConfig;
import org.apache.kafka.clients.consumer.OffsetResetStrategy;
@@ -41,6 +41,7 @@ import org.slf4j.LoggerFactory;
import java.util.Locale;
import java.util.Properties;
+import java.util.Random;
import java.util.Set;
import java.util.regex.Pattern;
@@ -279,7 +280,8 @@ public class DynamicKafkaSourceBuilder<T> {
KafkaSourceOptions.CLIENT_ID_PREFIX.key(),
props.containsKey(ConsumerConfig.GROUP_ID_CONFIG)
? props.getProperty(ConsumerConfig.GROUP_ID_CONFIG)
- : "DynamicKafkaSource-" +
RandomStringUtils.randomAlphabetic(8),
+ : "DynamicKafkaSource-"
+ +
StringUtils.generateRandomAlphanumericString(new Random(), 8),
false);
}
diff --git a/pom.xml b/pom.xml
index c7b8143b..96bd6c66 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,38 +57,31 @@ under the License.
<kafka.version>4.2.0</kafka.version>
<!-- Other Dependencies -->
- <avro.version>1.12.0</avro.version>
+ <avro.version>1.12.2</avro.version>
<byte-buddy.version>1.12.10</byte-buddy.version>
- <commons-cli.version>1.9.0</commons-cli.version>
- <commons-codec.version>1.18.0</commons-codec.version>
<commons-compress.version>1.27.1</commons-compress.version>
<commons-io.version>2.19.0</commons-io.version>
<commons-lang3.version>3.18.0</commons-lang3.version>
<httpcore.version>4.4.16</httpcore.version>
<httpclient.version>4.5.14</httpclient.version>
- <jackson-bom.version>2.21.3</jackson-bom.version>
- <javassist.version>3.30.2-GA</javassist.version>
+ <jackson-bom.version>2.22.4</jackson-bom.version>
<jsr305.version>1.3.9</jsr305.version>
<kryo.version>5.6.2</kryo.version>
- <log4j.version>2.25.5</log4j.version>
- <objenesis.version>3.4</objenesis.version>
+ <log4j.version>2.26.1</log4j.version>
<scala.binary.version>2.12</scala.binary.version>
<scala-library.version>${scala.binary.version}.20</scala-library.version>
<scala-reflect.version>${scala.binary.version}.20</scala-reflect.version>
<slf4j.version>1.7.36</slf4j.version>
- <snakeyaml.version>2.4</snakeyaml.version>
+ <snakeyaml.version>2.7</snakeyaml.version>
<snappy-java.version>1.1.10.7</snappy-java.version>
<!-- Test Dependencies -->
<archunit.version>1.4.1</archunit.version>
<assertj.version>3.27.7</assertj.version>
- <docker-java-api.version>3.5.2</docker-java-api.version>
- <guava.version>33.4.8-jre</guava.version>
+ <docker-java-api.version>3.7.1</docker-java-api.version>
+ <guava.version>33.7.2-jre</guava.version>
<hamcrest.version>1.3</hamcrest.version>
<junit5.version>5.13.3</junit5.version>
- <mockito.version>5.18.0</mockito.version>
- <powermock.version>2.0.9</powermock.version>
- <snakeyaml.version>2.4</snakeyaml.version>
<testcontainers.version>1.21.4</testcontainers.version>
<!-- Plugins -->
@@ -273,12 +266,6 @@ under the License.
<version>${byte-buddy.version}</version>
</dependency>
- <dependency>
- <groupId>commons-cli</groupId>
- <artifactId>commons-cli</artifactId>
- <version>${commons-cli.version}</version>
- </dependency>
-
<dependency>
<groupId>org.scala-lang</groupId>
<artifactId>scala-reflect</artifactId>
@@ -303,12 +290,6 @@ under the License.
<version>${snappy-java.version}</version>
</dependency>
- <dependency>
- <groupId>org.javassist</groupId>
- <artifactId>javassist</artifactId>
- <version>${javassist.version}</version>
- </dependency>
-
<dependency>
<groupId>org.apache.avro</groupId>
<artifactId>avro</artifactId>
@@ -387,12 +368,6 @@ under the License.
<version>${jsr305.version}</version>
</dependency>
- <dependency>
- <groupId>commons-codec</groupId>
- <artifactId>commons-codec</artifactId>
- <version>${commons-codec.version}</version>
- </dependency>
-
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpcore</artifactId>
@@ -470,13 +445,6 @@ under the License.
<version>${kryo.version}</version>
</dependency>
- <!-- For dependency convergence -->
- <dependency>
- <groupId>org.objenesis</groupId>
- <artifactId>objenesis</artifactId>
- <version>${objenesis.version}</version>
- </dependency>
-
<!-- For dependency convergence -->
<dependency>
<groupId>org.yaml</groupId>
