Github user StephanEwen commented on the issue:
https://github.com/apache/flink/pull/5891
All new dependencies are okay with the Apache License (not for shading,
though!)
Because nothing gets shaded here and we left dependency management to the
user, this upgrade is okay.
Merging this...---
