[
https://issues.apache.org/jira/browse/KAFKA-21056?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134298#comment-18134298
]
Muralidhar Basani commented on KAFKA-21056:
-------------------------------------------
[~rursprung] this is an interesting one especially with dependabot/automated
PRs, and faster CVEs, plugins.
Currently it is manual to find an outdated dependency and update it. This year
alone there were 60 commits to dependencies.gradle.
However there are strong reasons I believe to not handle automated PR for
dependencies.
[~chia7712] any thoughts please.
> migrate to gradle version catalog
> ---------------------------------
>
> Key: KAFKA-21056
> URL: https://issues.apache.org/jira/browse/KAFKA-21056
> Project: Kafka
> Issue Type: Improvement
> Reporter: Ralph Ursprung
> Priority: Minor
>
> the kafka project currently has its own custom
> [{{dependencies.gradle}}|https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle]
> mechanism to manage dependency versions.
> gradle nowadays has a standard way of dealing with this, the [version
> catalog|https://docs.gradle.org/current/userguide/version_catalogs.html],
> which is also clearly listed as part of their [best
> practices|https://docs.gradle.org/current/userguide/best_practices_dependencies.html#use_version_catalogs].
> i'd suggest to migrate the custom handling to version catalogs as this is
> known to most standard tooling. you can then e.g. also enable GitHub
> Dependabot for automated dependency update PRs, since it supports the version
> catalog.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
