[
https://issues.apache.org/jira/browse/FLINK-40617?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Purushottam Sinha updated FLINK-40617:
--------------------------------------
Description:
Several third-party dependency versions pinned in the root pom.xml are updated,
and dependencyManagement entries that no longer serve a purpose are pruned.
Bumped:
- jackson-bom 2.21.3 -> 2.22.2 (compile-scope, ships in
flink-connector-kafka.jar).
- log4j 2.25.4 -> 2.26.1, avro 1.12.0 -> 1.12.2, commons-codec 1.18.0 ->
1.22.1, archunit 1.4.1 -> 1.5.0, docker-java-api 3.5.2 -> 3.7.1, guava
33.4.8-jre -> 33.7.1-jre, snakeyaml 2.4 -> 2.7 (test-scope).
Dropped:
- commons-cli, javassist and objenesis: every reactor path already resolves a
single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing. Removed
the property and the dependencyManagement entry.
- the mockito and powermock version properties: both groups are banned by
enforce-banned-deps, so nothing can use them.
- the duplicate snakeyaml.version property.
Left at their prior pins (kept for convergence, not raised):
- commons-io (2.19.0) and commons-compress (1.27.1) are supplied by flink-dist
as provided dependencies; the pins only reconcile transitive convergence, so
bumping them changes nothing that runs on a cluster.
- snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
commons-lang3 moves to test-scope: its one production call in
DynamicKafkaSourceBuilder is replaced with Flink's
StringUtils.generateRandomAlphanumericString, keeping it off every user's
classpath.
See PR: https://github.com/apache/flink-connector-kafka/pull/306
was:
Several third-party dependency versions pinned in the root pom.xml are behind
current upstream releases. Bumping them keeps the connector aligned with Flink
master pins and current Maven Central releases.
- jackson-bom 2.21.3 -> 2.22.2 (compile-scope, ships in
flink-connector-kafka.jar); matches Flink master pin.
- log4j 2.25.4 -> 2.26.1 (test-scope); matches Flink master pin.
- avro 1.12.0 -> 1.12.2 (test-scope); latest patch on the 1.12.x line.
- Hygiene bumps with no known issues: commons-cli, commons-codec,
commons-compress, commons-io, commons-lang3, javassist, objenesis, snakeyaml,
snappy-java, archunit, docker-java-api, guava.
See PR: https://github.com/apache/flink-connector-kafka/pull/306
Summary: Connectors/Kafka: Prune and bump dependency versions in the
root pom (was: Connectors/Kafka: Bump jackson-bom, log4j, avro, and other
dependency versions)
> Connectors/Kafka: Prune and bump dependency versions in the root pom
> --------------------------------------------------------------------
>
> Key: FLINK-40617
> URL: https://issues.apache.org/jira/browse/FLINK-40617
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Kafka
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> Several third-party dependency versions pinned in the root pom.xml are
> updated, and dependencyManagement entries that no longer serve a purpose are
> pruned.
> Bumped:
> - jackson-bom 2.21.3 -> 2.22.2 (compile-scope, ships in
> flink-connector-kafka.jar).
> - log4j 2.25.4 -> 2.26.1, avro 1.12.0 -> 1.12.2, commons-codec 1.18.0 ->
> 1.22.1, archunit 1.4.1 -> 1.5.0, docker-java-api 3.5.2 -> 3.7.1, guava
> 33.4.8-jre -> 33.7.1-jre, snakeyaml 2.4 -> 2.7 (test-scope).
> Dropped:
> - commons-cli, javassist and objenesis: every reactor path already resolves a
> single version (1.5.0, 3.24.0-GA, 3.4), so the pins reconciled nothing.
> Removed the property and the dependencyManagement entry.
> - the mockito and powermock version properties: both groups are banned by
> enforce-banned-deps, so nothing can use them.
> - the duplicate snakeyaml.version property.
> Left at their prior pins (kept for convergence, not raised):
> - commons-io (2.19.0) and commons-compress (1.27.1) are supplied by
> flink-dist as provided dependencies; the pins only reconcile transitive
> convergence, so bumping them changes nothing that runs on a cluster.
> - snappy-java stays at 1.1.10.7, the version kafka-clients already brings.
> commons-lang3 moves to test-scope: its one production call in
> DynamicKafkaSourceBuilder is replaced with Flink's
> StringUtils.generateRandomAlphanumericString, keeping it off every user's
> classpath.
> See PR: https://github.com/apache/flink-connector-kafka/pull/306
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
