[Snyk] Fix for 1 vulnerabilities

[d4v1de]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	828	com.fasterxml.jackson.dataformat:jackson-dataformat-csv: 2.16.2 -> 2.18.8 org.apache.kafka:connect-json: 3.9.1 -> 4.0.0 org.apache.kafka:connect-runtime: 3.9.1 -> 4.0.0 Major version upgrade Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[d4v1de]

The upgrade of Apache Kafka from version 3.9.1 to 4.0.0 is a high-risk major update with significant breaking changes. The upgrade for jackson-dataformat-csv is low-risk.

org.apache.kafka:connect-json / connect-runtime (3.9.1 → 4.0.0)

Risk: HIGH

This major version upgrade introduces fundamental architectural changes and new prerequisites that require developer action and planning.

Key Breaking Changes:

• Java 17 Requirement: Kafka Brokers, Connect, and Tools now require Java 17 to run, a significant jump from previous versions.
• ZooKeeper Removed: Kafka 4.0.0 operates exclusively in KRaft mode, completely removing support for ZooKeeper. Clusters must be migrated to KRaft before upgrading to version 4.0.0.
• Removed APIs: Following KIP-896, APIs deprecated for over a year have been removed. For Kafka Connect, the GET /connectors/{connector}/tasks-config endpoint is removed and must be replaced with GET /connectors/{connector}/tasks.
• Log4j2 Migration: The logging framework has been updated from Log4j to Log4j2, which may require changes to custom logging configurations.
• Dependency Change: Kafka Streams no longer includes a compile-time dependency on connect-json. Projects relying on this transitive dependency must now add it explicitly.

Recommendation:
Do not merge this upgrade without a comprehensive migration plan. The environment must be upgraded to Java 17, and the Kafka cluster must be migrated from ZooKeeper to KRaft before this dependency update can be applied.

com.fasterxml.jackson.dataformat:jackson-dataformat-csv (2.16.2 → 2.18.8)

Risk: LOW

This is a minor version upgrade. The release notes for versions 2.17 and 2.18 indicate no major breaking API changes for the CSV data format module. One minor behavioral change in version 2.17 is stricter parsing of stringified numbers, where strings with leading zeros (e.g., "07") are no longer coerced to numeric types. The 2.18 release removes internal synchronization from CsvMapper for performance improvement.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.