[Snyk] Fix for 1 vulnerabilities

[pushkala-datastax]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	710	org.apache.kafka:connect-runtime: 3.4.0 -> 4.0.0 Major version upgrade No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade com.fasterxml.jackson.core:jackson-databind@2.16.0 to com.fasterxml.jackson.core:jackson-databind@2.18.8; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/com/fasterxml/jackson/jackson-bom/2.16.0/jackson-bom-2.16.0.pom
• Could not upgrade com.fasterxml.jackson.dataformat:jackson-dataformat-yaml@2.16.0 to com.fasterxml.jackson.dataformat:jackson-dataformat-yaml@2.18.8; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/com/fasterxml/jackson/jackson-bom/2.16.0/jackson-bom-2.16.0.pom

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[pushkala-datastax]

This update includes a major version upgrade for Apache Kafka, which introduces significant breaking changes. The Jackson library upgrades are minor but include behavioral changes that warrant review.

HIGH RISK: org.apache.kafka:connect-runtime@3.4.0 → 4.0.0

This is a major version upgrade that fundamentally changes Kafka's architecture and APIs. Developer action is required.

Breaking Changes:

• ZooKeeper Removal: Kafka 4.0 removes the dependency on ZooKeeper for cluster metadata management, replacing it with a self-managed KRaft-based control plane. This is a major architectural overhaul that impacts cluster design, operations, and upgrades.
• API Removal: The KStreams#transformValues() method has been removed. Code must be migrated to use KStreams#processValues() instead.
• Java Version Requirement: Kafka 4.0 requires Java 11 or newer for clients, and Java 17 or newer for brokers and tools.
• Broker Compatibility: Kafka Streams 4.0 is only compatible with Kafka brokers running version 2.1 or newer.

Recommendation: This upgrade cannot be merged without significant planning and code migration. A dedicated migration plan is necessary to address the architectural shift from ZooKeeper to KRaft and to update code to use the new APIs.

MEDIUM RISK: Jackson Upgrades (2.16.0 → 2.18.8)

While these are minor version upgrades for jackson-databind and jackson-dataformat-yaml, the range includes several behavioral changes and an internal rewrite that could impact existing functionality.

Key Changes:

• Stricter Number Parsing (2.17): JSON strings with leading zeroes (e.g., "07") are no longer coerced into numbers, which may affect enum or numeric deserialization.
• Internal Introspection Rewrite (2.18): A significant internal rewrite of the POJO property introspection mechanism was done. While intended to fix bugs, this could introduce subtle behavioral changes.
• Kotlin Support: Support for Kotlin 1.7.x was removed in version 2.18.
• YAML Module: The YAML dataformat module received updates for stream nesting depth limits and other minor enhancements.

Recommendation: Thoroughly test all JSON and YAML serialization/deserialization paths after this upgrade, paying close attention to number handling, constructor-based deserialization, and any use of Kotlin data classes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.