The issues with Groovy are clearly ongoing and this change does serve to generally reduce its footprint in TinkerPop. I am concerned that if we can't get off of Groovy 2.x we're eventually going to reach a point where we're blocked by the JDK (i.e. –illegal-access=permit goes away soon enough) or simply by some CVEs that aren't addressed properly. All that aside though, I think that this is a good chance to simplify the dependency tree on one of the most used modules in the set. Having Groovy in gremlin-driver for a feature that probably shouldn't have been built and likely isn't used feels a bit of a waste.
On Thu, Jul 22, 2021 at 1:44 PM David Bechberger <[email protected]> wrote: > Is reason for removing it is that this underlying groovy issue ( > https://issues.apache.org/jira/browse/GROOVY-9785) is blocking the > upgrade? > > > > On Thu, Jul 22, 2021 at 9:40 AM Stephen Mallette <[email protected]> > wrote: > > > In 3.6.0 I think it worth taking the step to remove all groovy > dependencies > > from gremlin-driver. They were made <optional> in 3.5.0 and based on > there > > being no replies to this query on usage of the feature related to this > > dependency: > > > > https://groups.google.com/g/gremlin-users/c/vFPNwbHFl4w/m/U11fOLhWAgAJ > > > > I think that we can safely remove it. I believe that the impact here is > > only to GraphSON and Gryo. For Gryo, we've already deprecated it as a > > network protocol, but it was already an optional registration so if you > > needed it you could copy/paste the simple bit of code related to it and > > maintain it yourself. For GraphSON, it was made an standard part of the > > GremlinServerModule, but I think like, Gryo it would be easy enough to > > maintain your own custom version. > > > > Created this to track it: > > https://issues.apache.org/jira/browse/TINKERPOP-2593 > > > > Please let me know if there are any concerns. > > >
