[
https://issues.apache.org/jira/browse/CALCITE-7259?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mihai Budiu resolved CALCITE-7259.
----------------------------------
Fix Version/s: 1.42.0
Resolution: Fixed
Fixed in
[https://github.com/apache/calcite/commit/174a79b03e54be0712cc9cfe1e14465a37b801b2]
Thank you for the contributin [~hongyuguo]
> Drop commons-lang3 dependency
> -----------------------------
>
> Key: CALCITE-7259
> URL: https://issues.apache.org/jira/browse/CALCITE-7259
> Project: Calcite
> Issue Type: Improvement
> Affects Versions: 1.40.0
> Reporter: Vladimir Sitnikov
> Assignee: hongyu guo
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.42.0
>
>
> Currently Calcite uses only a few classes from commons-lang3, and it would
> probably be worth dropping the dependency for the following reasons:
> 1) Better security. commons-* follows "all features in a single jar" pattern,
> so a CVE in one of the classes would impact Calcite
> 2) Fewer bytes to ship with binary distribution for the end-users:
> `commons-lang3` is ~690K
> I have raised a suggestion to make commons-lang3 modular and extract modules
> like commons-stringutils, commons-arrayutils, however, {{Commons}} team does
> not seem to like the idea.
> Commons PMC members often suggest that users should clone the code or shade
> commons-lang, see
> https://lists.apache.org/thread/xzdhv57o9rnxtzn5fqbtkzj0hdkbm339
> So I wonder what do you think of dropping commons-lang3 and replacing it with
> core Java?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
