[jira] [Commented] (KAFKA-15138) Java kafka-clients compression dependencies should be optional

["Joe DiPol (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-15138?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121761#comment-18121761 ] 

Joe DiPol commented on KAFKA-15138:
-----------------------------------

The CVEs on these compression libraries continue:

  [ERROR] lz4-java-1.10.1.jar (pkg:maven/at.yawk.lz4/lz4-java@1.10.1): CVE-2026-59949(6.5)
  [ERROR] snappy-java-1.1.10.5.jar (pkg:maven/org.xerial.snappy/snappy-java@1.1.10.5,
  cpe:2.3:a:xerial:snappy-java:1.1.10.5:*:*:*:*:*:*:*): CVE-2026-93452(8.699999809265137), CVE-2026-
  93451(6.900000095367432), CVE-2026-90559(8.699999809265137)
  [ERROR] zstd-jni-1.5.6-4.jar (pkg:maven/com.github.luben/zstd-jni@1.5.6-4): CVE-2026-
  87823(8.800000190734863), CVE-2026-87795(8.800000190734863), CVE-2026-89045(5.099999904632568)

The snappy project hasn't had a commit by a human in almost a year -- despite multiple CVEs.

We know the situation with Lz4-java

Yet the kafka client still insists on requiring them as transitive dependencies. Can you please make these optional?

> Java kafka-clients compression dependencies should be optional
> --------------------------------------------------------------
>
>                 Key: KAFKA-15138
>                 URL: https://issues.apache.org/jira/browse/KAFKA-15138
>             Project: Kafka
>          Issue Type: Bug
>          Components: clients
>    Affects Versions: 3.4.0
>            Reporter: Joe DiPol
>            Priority: Major
>
> If you look at
> [https://repo1.maven.org/maven2/org/apache/kafka/kafka-clients/3.4.0/kafka-clients-3.4.0.pom]
> You see that the dependencies for the compression libraries (like lz4-java) do NOT have "{{{}<optional>true</optional>{}}}". That means that these libraries are transitive dependencies which will be pulled (and potentially security scanned) for any project that uses kafka-clients. 
> This is not correct. These compression libraries are optional and should not be transitive dependencies of kafka-clients. Therefore the above pom should state {{optional}} like:
> {{
> <dependency>
>     <groupId>org.lz4</groupId>
>     <artifactId>lz4-java</artifactId>
>     <version>1.8.0</version>
>     <scope>runtime</scope>
>     <optional>true</optional>
> </dependency>
> }}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)