MartijnVisser commented on code in PR #306:
URL:
https://github.com/apache/flink-connector-kafka/pull/306#discussion_r4085840709
##########
pom.xml:
##########
@@ -57,38 +57,32 @@ under the License.
<kafka.version>4.2.0</kafka.version>
<!-- Other Dependencies -->
- <avro.version>1.12.0</avro.version>
+ <avro.version>1.12.2</avro.version>
<byte-buddy.version>1.12.10</byte-buddy.version>
- <commons-cli.version>1.9.0</commons-cli.version>
- <commons-codec.version>1.18.0</commons-codec.version>
+ <commons-codec.version>1.22.1</commons-codec.version>
Review Comment:
This is provided too, through Flink's commons-compress, and every path asks
for 1.17.1. Like commons-cli, I'd drop the pin rather than raise it.
##########
pom.xml:
##########
@@ -57,38 +57,32 @@ under the License.
<kafka.version>4.2.0</kafka.version>
<!-- Other Dependencies -->
- <avro.version>1.12.0</avro.version>
+ <avro.version>1.12.2</avro.version>
<byte-buddy.version>1.12.10</byte-buddy.version>
- <commons-cli.version>1.9.0</commons-cli.version>
- <commons-codec.version>1.18.0</commons-codec.version>
+ <commons-codec.version>1.22.1</commons-codec.version>
<commons-compress.version>1.27.1</commons-compress.version>
<commons-io.version>2.19.0</commons-io.version>
- <commons-lang3.version>3.18.0</commons-lang3.version>
+ <commons-lang3.version>3.20.0</commons-lang3.version>
<httpcore.version>4.4.16</httpcore.version>
<httpclient.version>4.5.14</httpclient.version>
- <jackson-bom.version>2.21.3</jackson-bom.version>
- <javassist.version>3.30.2-GA</javassist.version>
+ <jackson-bom.version>2.22.2</jackson-bom.version>
Review Comment:
2.21.3 is affected by eleven Jackson advisories, three of them high, and
2.22.2 clears all of them. That's the actual reason for this bump, so it
belongs in the commit message.
##########
pom.xml:
##########
@@ -57,38 +57,32 @@ under the License.
<kafka.version>4.2.0</kafka.version>
<!-- Other Dependencies -->
- <avro.version>1.12.0</avro.version>
+ <avro.version>1.12.2</avro.version>
<byte-buddy.version>1.12.10</byte-buddy.version>
- <commons-cli.version>1.9.0</commons-cli.version>
- <commons-codec.version>1.18.0</commons-codec.version>
+ <commons-codec.version>1.22.1</commons-codec.version>
<commons-compress.version>1.27.1</commons-compress.version>
<commons-io.version>2.19.0</commons-io.version>
- <commons-lang3.version>3.18.0</commons-lang3.version>
+ <commons-lang3.version>3.20.0</commons-lang3.version>
Review Comment:
This bump isn't mentioned anywhere. Only tests use it now and flink-core
brings 3.18.0, so it can stay at 3.18.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
