I'm really looking forward to a future ZooKeeper release that does not require that clients ship with Netty JARs (assuming TLS isn't needed at a Java layer). Netty seems to get so many CVEs! https://issues.apache.org/jira/browse/ZOOKEEPER-4835 I have a PR awaiting a review for weeks now.
~ David Smiley Apache Lucene/Solr Search Developer http://www.linkedin.com/in/davidwsmiley
