MINOR: Update dependencies (minor versions only) #13673

divijvaidya · 2023-05-04T12:10:10Z

All dependency upgrades in the PR are minor upgrades with backward compatible changes. Note that no major version for dependencies have been changed to make it a low risk change. No code changes are required for any of these dependencies. There are separate PRs such as #13662 which will upgrade the major versions.

Release notes for dependencies:

bcpkix 1.70 -> 1.73

Release notes:
https://www.bouncycastle.org/releasenotes.html#r1rv72
https://www.bouncycastle.org/releasenotes.html#r1rv73

httpclient 4.5.13 -> 4.5.14

Some perf fixes, resource de-allocation fixes and no retry in case of NoRouteToHostException
Release notes: https://downloads.apache.org/httpcomponents/httpclient/RELEASE_NOTES-4.5.x.txt

jline 3.21.0 -> 3.22.0

Bug fixes.

Breaking change (doesn't impact us) -

SyntaxHighlighter has been moved from org.jline.builtins.Nano.SyntaxHighlighter to org.jline.builtins.SyntaxHighlighter

Release notes: https://github.com/jline/jline3/releases/tag/jline-parent-3.22.0

jaxb 2.3.0 -> 2.3.1

Can't find release notes! But https://mvnrepository.com/artifact/javax.xml.bind/jaxb-api/2.3.1 is the latest version in maven.

netty 4.1.86.Final -> 4.1.92.Final

Release notes:
https://netty.io/news/2023/04/25/4-1-92-Final.html
https://netty.io/news/2023/04/03/4-1-91-Final.html
https://netty.io/news/2023/02/13/4-1-89-Final.html
https://netty.io/news/2023/02/12/4-1-88-Final.html
https://netty.io/news/2023/01/12/4-1-87-Final.html

reload4j 1.2.19 -> 1.2.25

Fixed a newly discovered XXE vector vulnerability reported against Chainsaw.
Performance improvements
Release notes: https://reload4j.qos.ch/news.html

scalaCollectionCompat 2.6.0 -> 2.10.0

Fixes CVE GHSA-8qv5-68g4-248j , new features (such as Option.when and Iterator.nextOption) and perf improvements.

Release notes:
https://github.com/scala/scala-collection-compat/releases/tag/v2.10.0
https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0
https://github.com/scala/scala-collection-compat/releases/tag/v2.8.0
https://github.com/scala/scala-collection-compat/releases/tag/v2.7.0

Build and test dependencies

junit 5.9.2 -> 5.9.3

Minor bug fixes. Improvements associated with @MethodSource annotation.
Release notes: https://junit.org/junit5/docs/current/release-notes/index.html#release-notes-5.9.3

jacoco 0.8.8 -> 0.8.10

Release notes:
https://github.com/jacoco/jacoco/releases/tag/v0.8.10
https://github.com/jacoco/jacoco/releases/tag/v0.8.9

scoverage 1.4.11 -> 1.9.3

Release notes:
https://github.com/scoverage/sbt-scoverage/releases?page=2

Compatibility

Verified build and test with JDK8 and JDK 17

machi1990 · 2023-05-04T12:37:52Z

Thanks @divijvaidya I am wondering whether it is best to separate each upgrade on a separate PR? That makes each dependency update atomic and thus easier to revert in case we notice issue related to a specific dependency upgrade. What do you think?

machi1990 · 2023-05-04T12:39:20Z

In relation to dependency upgrade, has there been any discussion around automated tooling e.g usage of dependabot or renovate?

divijvaidya · 2023-05-04T12:52:47Z

Thanks for your comment @machi1990. In principle what you say is right but given the limited committer bandwidth in the community, I am trying to optimize for code reviewer comfort right now. That is why I have intentionally added only the non-controversial upgrades here in the PR. In case of a need for rollback, we can always choose to roll-forward by modifying the version of a specific dependency.

divijvaidya · 2023-05-04T12:55:51Z

In relation to dependency upgrade, has there been any discussion around automated tooling e.g usage of dependabot or renovate?

I don't know. I have seen @ijuma being the one who periodically performs dependency upgrades. He may be able to provide more info about this. Dependabot is a good idea (and some other Apache communities use it), except when it leads to noise. I don't know if there is a way to "mute" it and enable only at the beginning of a release cycle.

machi1990 · 2023-05-04T13:11:11Z

In relation to dependency upgrade, has there been any discussion around automated tooling e.g usage of dependabot or renovate?

I don't know. I have seen @ijuma being the one who periodically performs dependency upgrades. He may be able to provide more info about this.

Thanks, I'll be interested in any details that could be provided @ijuma

Dependabot is a good idea (and some other Apache communities use it), except when it leads to noise. I don't know if there is a way to "mute" it and enable only at the beginning of a release cycle.

Yes, it is possible. With dependabot you can limit the number of PRs opened. Setting the limit to 0 will equate disabling depedency update for a given package ecosystem. Renovate has a disabling flag, which could be used.

bmscomp · 2023-05-05T00:11:02Z

It's a good think to keep dependencies up to date

divijvaidya · 2023-05-05T11:48:22Z

gradle/dependencies.gradle

@@ -142,7 +142,7 @@ libs += [
  apachedsMavibotPartition: "org.apache.directory.server:apacheds-mavibot-partition:$versions.apacheds",
  apachedsJdbmPartition: "org.apache.directory.server:apacheds-jdbm-partition:$versions.apacheds",
  argparse4j: "net.sourceforge.argparse4j:argparse4j:$versions.argparse4j",
-  bcpkix: "org.bouncycastle:bcpkix-jdk15on:$versions.bcpkix",
+  bcpkix: "org.bouncycastle:bcpkix-jdk18on:$versions.bcpkix",


FYI, reviewers, this changes the version of bouncycaste which is compatible from JDK 1.8 onwards instead of earlier JDK 1.5.

divijvaidya · 2023-05-10T14:51:07Z

@ijuma, requesting your thoughts about merging this in.

showuon

LGTM!

showuon · 2023-05-12T09:47:00Z

Failed tests are unrelated:

    Build / JDK 11 and Scala 2.13 / org.apache.kafka.connect.mirror.integration.MirrorConnectorsWithCustomForwardingAdminIntegrationTest.testOffsetTranslationBehindReplicationFlow()
    Build / JDK 11 and Scala 2.13 / org.apache.kafka.connect.integration.ExactlyOnceSourceIntegrationTest.testConnectorBoundary
    Build / JDK 11 and Scala 2.13 / kafka.admin.TopicCommandIntegrationTest.testDescribeUnderMinIsrPartitionsMixed(String).quorum=zk
    Build / JDK 11 and Scala 2.13 / kafka.api.ConsumerBounceTest.testCloseDuringRebalance()
    Build / JDK 8 and Scala 2.12 / org.apache.kafka.tools.MetadataQuorumCommandTest.[2] Type=Raft-Isolated, Name=testDescribeQuorumStatusSuccessful, MetadataVersion=3.5-IV2, Security=PLAINTEXT

All dependency upgrades in the PR are minor upgrades with backward compatible changes. Note that no major version for dependencies have been changed to make it a low risk change. No code changes are required for any of these dependencies. Reviewers: Luke Chen <[email protected]>

showuon · 2023-05-12T09:54:10Z

backported to v3.5 and v3.4

ijuma · 2023-05-12T12:45:33Z

@ijuma, requesting your thoughts about merging this in.

Looks good.

Update minor versions for dependencies

a06ed26

divijvaidya mentioned this pull request May 5, 2023

KAFKA-15208: Upgrade Jackson dependencies to version 2.16.0 #13662

Merged

3 tasks

divijvaidya commented May 5, 2023

View reviewed changes

divijvaidya marked this pull request as draft May 5, 2023 13:14

divijvaidya force-pushed the minor-spring-update branch from a06ed26 to e86380a Compare May 5, 2023 13:25

Revert mockito upgrade

2f439c7

divijvaidya force-pushed the minor-spring-update branch from e86380a to 2f439c7 Compare May 5, 2023 13:40

divijvaidya marked this pull request as ready for review May 5, 2023 16:20

showuon approved these changes May 12, 2023

View reviewed changes

showuon merged commit f578b38 into apache:trunk May 12, 2023

divijvaidya deleted the minor-spring-update branch May 15, 2023 12:26

eziosudo mentioned this pull request Jul 10, 2023

KAFKA-15159: upgrade minor dependencies #13982

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MINOR: Update dependencies (minor versions only) #13673

MINOR: Update dependencies (minor versions only) #13673

divijvaidya commented May 4, 2023 •

edited

Loading

machi1990 commented May 4, 2023

machi1990 commented May 4, 2023

divijvaidya commented May 4, 2023

divijvaidya commented May 4, 2023

machi1990 commented May 4, 2023

bmscomp commented May 5, 2023

divijvaidya May 5, 2023 •

edited

Loading

divijvaidya commented May 10, 2023

showuon left a comment

showuon commented May 12, 2023

showuon commented May 12, 2023 •

edited

Loading

ijuma commented May 12, 2023

MINOR: Update dependencies (minor versions only) #13673

MINOR: Update dependencies (minor versions only) #13673

Conversation

divijvaidya commented May 4, 2023 • edited Loading

Release notes for dependencies:

bcpkix 1.70 -> 1.73

httpclient 4.5.13 -> 4.5.14

jackson and jackson-databind 2.13.4 -> 2.13.5

javaassist 3.27.0-GA -> 3.29.2-GA

jetty 9.4.48.v20220622 -> 9.4.51.v20230217

jersey 2.34 -> 2.39.1

jline 3.21.0 -> 3.22.0

Breaking change (doesn't impact us) -

jaxb 2.3.0 -> 2.3.1

netty 4.1.86.Final -> 4.1.92.Final

reload4j 1.2.19 -> 1.2.25

scalaCollectionCompat 2.6.0 -> 2.10.0

Build and test dependencies

junit 5.9.2 -> 5.9.3

jacoco 0.8.8 -> 0.8.10

scoverage 1.4.11 -> 1.9.3

Compatibility

machi1990 commented May 4, 2023

machi1990 commented May 4, 2023

divijvaidya commented May 4, 2023

divijvaidya commented May 4, 2023

machi1990 commented May 4, 2023

bmscomp commented May 5, 2023

divijvaidya May 5, 2023 • edited Loading

Choose a reason for hiding this comment

divijvaidya commented May 10, 2023

showuon left a comment

Choose a reason for hiding this comment

showuon commented May 12, 2023

showuon commented May 12, 2023 • edited Loading

ijuma commented May 12, 2023

divijvaidya commented May 4, 2023 •

edited

Loading

divijvaidya May 5, 2023 •

edited

Loading

showuon commented May 12, 2023 •

edited

Loading