Repository navigation
chore(deps): bump org.apache.kafka:kafka-clients from 3.8.1 to 4.4.0 - #6404
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps org.apache.kafka:kafka-clients from 3.8.1 to 4.4.0. --- updated-dependencies: - dependency-name: org.apache.kafka:kafka-clients dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📲 Install BuildsAndroid
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6df36ac. Configure here.
| spring-kafka4 = { module = "org.springframework.kafka:spring-kafka" } | ||
| spring-kafka4-test = { module = "org.springframework.kafka:spring-kafka-test" } | ||
| kafka-clients = { module = "org.apache.kafka:kafka-clients", version = "3.8.1" } | ||
| kafka-clients = { module = "org.apache.kafka:kafka-clients", version = "4.4.0" } |
There was a problem hiding this comment.
Major Kafka clients bump is unsafe
High Severity
This Dependabot change jumps kafka-clients a major version, from 3.8.1 to 4.4.0, without a callout that the supported Kafka or Java floor is changing. sentry-kafka compiles and tests against this catalog entry and still uses spring-kafka3-test, which only supports Kafka 3.8–3.9, so the in-JVM EmbeddedKafkaKraftBroker tests will fail. Kafka 4.x clients also require Java 11, which raises the effective compile/test baseline for a Java 8 module that is meant to work with Kafka 3.x users.
Triggered by project rule: PR Review Guidelines for Cursor Bugbot
Reviewed by Cursor Bugbot for commit 6df36ac. Configure here.
|
I think this one is designed to be pinned. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps org.apache.kafka:kafka-clients from 3.8.1 to 4.4.0.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)