time to upgrade the constraints again to 2.17.0? 😅 https://thehackernews.com/2021/12/apache-issues-3rd-patch-to-fix-new-high.html

Thank you!

Hello, when will this changed be merged & reflected on helm chart? 🙂

these being constraints imposed on gradle build, it shouldnt have any material impact if you do not modify stock datahub in any way, correct? we only really need the changes to the ES JVM? (pardon my non-existent java understanding) https://datahubspace.slack.com/archives/CUMV92XRQ/p1639496478161900?thread_ts=1639172349.145600&cid=CUMV92XRQ

Hey! So it appears that some of the 3rd party libraries we depend on do indeed pull in a log4j dependency. Adding these constraints will force those dependencies to use the latest version. We as DataHub do not directly depend on or use log4j, instead we use logback. Nonetheless we want to make sure that the affected versions are not in our dependency tree at all

3th code merge with upstream in a week for me 🥲

oh myyyyy

cant be helped, all the IT security folks are freaked out by it