Copilot commented on code in PR #98:
URL: https://github.com/apache/pulsar-connectors/pull/98#discussion_r3561185209
##########
canal/build.gradle.kts:
##########
@@ -21,6 +21,17 @@ plugins {
id("pulsar-connectors.java-conventions")
id("pulsar-connectors.nar-conventions")
}
+// canal.protocol/canal.client 1.1.7 were generated against protobuf-java
3.6.1: their generated
+// CanalPacket code calls GeneratedMessageV3.makeExtensionsImmutable(), which
was removed in
+// protobuf-java 4.x. The shared dependency platform force-upgrades
protobuf-java to 4.31.1, which
+// makes the canal client throw NoSuchMethodError on connect() and leaves the
connector unable to
+// talk to canal-server at all. Pin protobuf-java back to the version canal
declares so the client
+// (and this module's NAR) works. See CanalStringSourceIntegrationTest.
Review Comment:
The Gradle comment claims the shared dependency platform force-upgrades
protobuf-java to 4.31.1, but this repo’s enforced platform pins protobuf via
the version catalog (protobuf = 3.25.5). Please update this comment to avoid
pointing future readers at an incorrect version/context.
##########
canal/build.gradle.kts:
##########
@@ -21,6 +21,17 @@ plugins {
id("pulsar-connectors.java-conventions")
id("pulsar-connectors.nar-conventions")
}
+// canal.protocol/canal.client 1.1.7 were generated against protobuf-java
3.6.1: their generated
+// CanalPacket code calls GeneratedMessageV3.makeExtensionsImmutable(), which
was removed in
+// protobuf-java 4.x. The shared dependency platform force-upgrades
protobuf-java to 4.31.1, which
+// makes the canal client throw NoSuchMethodError on connect() and leaves the
connector unable to
+// talk to canal-server at all. Pin protobuf-java back to the version canal
declares so the client
+// (and this module's NAR) works. See CanalStringSourceIntegrationTest.
+configurations.all {
+ resolutionStrategy {
+ force("com.google.protobuf:protobuf-java:3.6.1")
+ }
+}
Review Comment:
This module forces protobuf-java to 3.6.1 across all configurations, which
is a large downgrade from the repo’s pinned protobuf version (3.25.5) and will
also flow into the shipped NAR. That can increase the risk of runtime classpath
conflicts with other Pulsar dependencies and may reintroduce old protobuf
bugs/security issues. If possible, consider isolating this (e.g.,
shading/relocation like kinesis-kpl-shaded does for protobuf, or upgrading
canal client/protocol) rather than downgrading protobuf for the entire module.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
