[
https://issues.apache.org/jira/browse/FLINK-40617?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Martijn Visser reassigned FLINK-40617:
--------------------------------------
Assignee: Purushottam Sinha
> Connectors/Kafka: Prune and bump dependency versions in the root pom
> --------------------------------------------------------------------
>
> Key: FLINK-40617
> URL: https://issues.apache.org/jira/browse/FLINK-40617
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Kafka
> Reporter: Purushottam Sinha
> Assignee: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> Several third-party dependency versions pinned in the root pom.xml are
> updated, and dependencyManagement entries that no longer serve a purpose are
> pruned.
> Bumped:
> - jackson-bom 2.21.3 -> 2.22.4 (compile-scope; not bundled, reaches users
> transitively through flink-connector-kafka). 2.21.3 is affected by 19 Jackson
> advisories, eight of them high severity; 2.22.4 clears all of them.
> - log4j 2.25.5 -> 2.26.1, avro 1.12.0 -> 1.12.2, docker-java-api 3.5.2 ->
> 3.7.1, guava 33.4.8-jre -> 33.7.2-jre, snakeyaml 2.4 -> 2.7 (test-scope).
> Dropped:
> - commons-cli, javassist and objenesis: every reactor path already resolves a
> single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing.
> Removed the property and the dependencyManagement entry.
> - commons-codec: provided transitively through flink-dist's commons-compress,
> and every reactor path already resolves it to 1.17.1, so the pin only raised
> a version nothing asked for. Removed the property and the
> dependencyManagement entry.
> - the mockito and powermock version properties: both groups are banned by
> enforce-banned-deps, so nothing can use them.
> - the duplicate snakeyaml.version property.
> Left at their prior pins (kept for convergence, not raised):
> - commons-io (2.19.0) and commons-compress (1.27.1) are supplied by
> flink-dist as provided dependencies; the pins only reconcile transitive
> convergence, so bumping them changes nothing that runs on a cluster.
> - snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
> commons-lang3 stays at 3.18.0 and moves to test-scope: its one production
> call in DynamicKafkaSourceBuilder is replaced with Flink's
> StringUtils.generateRandomAlphanumericString, keeping it off every user's
> classpath.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
