[
https://issues.apache.org/jira/browse/KAFKA-21055?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134315#comment-18134315
]
Muralidhar Basani commented on KAFKA-21055:
-------------------------------------------
[~rursprung] thanks for raising this.
I noticed the below
* Jackson 3 needs Java 17, and the client, streams, generator modules compile
on Java 11
* connect-json has Jackson types in its public api, so it needs a kip
* log4j2 YAML config still uses Jackson 2
And in general jackson 3 changes default behaviour like alphabetical property
ordering, failing on trailing tokens..etc
We can come up with an approach before we hit the actual deadline (late
2027/early 2028).
[~schofielaj] or [~chia7712] any thoughts please.
> upgrade from jackson 2.x to jackson 3.x
> ---------------------------------------
>
> Key: KAFKA-21055
> URL: https://issues.apache.org/jira/browse/KAFKA-21055
> Project: Kafka
> Issue Type: Improvement
> Reporter: Ralph Ursprung
> Priority: Major
>
> kafka currently uses jackson 2.x, see
> [{{dependencies.gradle}}|https://github.com/apache/kafka/blob/81e8ebc9f1648d7dfdfd0e8051a6dd39431f068a/gradle/dependencies.gradle#L65]
> jackson 3.x has now been out for a while and and the clock is counting down
> for jackson 2.x (2.21.x is an LTS with ~2 years of support acc. to their
> documents).
> more information can be found in their [migration
> guide|https://github.com/FasterXML/jackson/blob/main/jackson3/MIGRATING_TO_JACKSON_3.md]
> there are several reasons for migrating:
> * upgrade to the current major release of jackson to continue receiving
> support/updates long-term
> * hopefully fewer CVEs coming from jackson (i don't have any numbers for it,
> but i _feel_ like i've seen fewer CVEs issued for jackson 3.x than jackson
> 2.x?)
> * no leakage of jackson 2.x into other applications consuming kafka libraries
> the last point is the one which causes me to raise this issue: spring boot
> 4.1 upgraded from jackson 2.x to 3.x, however when using kafka (e.g. through
> the SB kafka starter) the application now contains both jackson 2.x and
> jackson 3.x. this means i have more dependencies rather than fewer (and more
> dependency updates to deal with).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
