search

vert-x3 / vertx-kafka-client

Reactive Kafka Client for Vert.x
Apache License 2.0
84 stars 82 forks source link

Upgrade kafka-clients from 3.5.0 to 3.7.0 fixing snappy vulnerabilities #265

Closed julianladisch closed 4 months ago

julianladisch commented 4 months ago

The kafka-clients upgrade indirectly upgrades snappy-java from 1.1.10.0 to 1.1.10.5 fixing these snappy-java vulnerablities:

kafka-clients 3.7.0 requires to bump the test dependency debezium from 2.1.4.Final to 2.6.1.Final.

tsegismont commented 4 months ago

@ppatierno is this ok to merge? Should we consider backporting?

tsegismont commented 4 months ago

Thanks for taking a look @ppatierno . What about backporting to 4.x?

ppatierno commented 4 months ago

Thanks for taking a look @ppatierno . What about backporting to 4.x?

I would say yes if 4.x will be still around for long. Do you want me to open a PR against the 4.x branch?

vietj commented 4 months ago

@ppatierno go ahead, we are planning a 4.5.x release next week

ppatierno commented 4 months ago

@vietj here the PR https://github.com/vert-x3/vertx-kafka-client/pull/266