[Snyk] Fix for 1 vulnerabilities

[chrislin22]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-18517159	710	io.debezium:debezium-core: 2.6.1.Final -> 3.5.0.Final org.apache.kafka:connect-runtime: 3.4.0 -> 4.0.0 org.apache.kafka:kafka_2.13: 3.4.0 -> 4.0.0 Major version upgrade No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[chrislin22]

This upgrade includes major versions for Apache Kafka and Debezium, introducing significant breaking changes that require mandatory environment and configuration updates.

1. org.apache.kafka:connect-runtime & kafka_2.13 (3.4.0 → 4.0.0)

Risk: HIGH

The upgrade to Apache Kafka 4.0.0 is a major architectural shift, primarily due to the complete removal of ZooKeeper.

Key Breaking Changes:

• ZooKeeper Removal: Kafka 4.0.0 operates exclusively in KRaft mode. Clusters currently using ZooKeeper must be migrated to KRaft mode before upgrading to version 4.0.
• Java Version Requirement: Kafka Brokers and Kafka Connect now require Java 17 to run. Kafka Clients require a minimum of Java 11.
• Jakarta EE Upgrade: Kafka Connect has been upgraded to use Jakarta EE 10 APIs, replacing the previous JavaEE dependencies. This may impact custom connectors or integrations.
• Legacy Protocol Removal: Support for several older client protocol API versions has been removed. Ensure clients are using a recent version (2.1 or higher) before upgrading the brokers.

Recommendation: Do not merge this upgrade without a comprehensive migration plan. The migration from ZooKeeper to KRaft is a multi-step process that must be completed on the 3.x version first. Validate all custom connectors against the new Jakarta EE dependency and ensure your runtime environment meets the Java 17 requirement.

2. io.debezium:debezium-core (2.6.1.Final → 3.5.0.Final)

Risk: HIGH

This major version upgrade for Debezium introduces a critical runtime dependency change.

Key Breaking Changes:

• Java 17 Requirement: All Debezium connectors require a Java 17 runtime environment. Debezium Server requires Java 21.
• Connector-Specific Changes: The release includes breaking changes for specific connectors, such as the Oracle connector, where the default mining strategy has changed and deprecated properties were removed.

Recommendation: Before upgrading, ensure the production environment and any build agents are configured with Java 17. Review the Debezium release notes for any breaking changes specific to the connectors you use.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.