Re: [DISCUSS] Next RC Question: Merging DRILL-8122

[James Turton <dz...@apache.org>]

I'm fine with the Kafka plugin fix (8122) if people want it in RC4, but 
not with the Jackson-BOM.  Jackson is a pervasive library and, for all I 
know about what the implications are for the effective library versions, 
this change could produce runtime regressions not revealed by our unit 
tests.  As far security gains go, the most vulnerable version of Jackson 
that we ship is shaded into a fat jar by Htrace and so not correctable 
by the BOM.  So my view is that this change can wait until we unfreeze, 
I doubt that users would see a difference.

On 2022/02/15 16:06, Charles Givre wrote:
> Hello all,
> I want to thank everyone for their work on the next Drill release.  It seems we keep finding teething bugs (grrr) in our RCs and we just found another…. Since the commit freeze, there are two pending PRs which are relatively minor and are passing CI.  (Excluding the blocker: DRILL-8134)
>
> The PR’s I’m referring to are DRILL-8122 Change Kafka Metadata, which fixes a bug relating to Kafka 2.0 and the PR w/o a Jira Issue to add the Jackson-BOM.  As we prepare for the next RC, I wanted to ask if anyone has any strong opinions as to whether we should merge these into the next RC or not.  They seem relatively minor, but as we all know, you never know what could go wrong, even with “minor” fixes.
>
> We will certainly merge these one way or the other… the question is whether to include them in the next RC or not.
>
> Thx,
> — C
>