[CASSANDRA-19654] Update bundled Cassandra cassandra-driver-core dependency

• Type: Task
• Status: Triage Needed
• Priority: Normal
• Resolution: Unresolved
• Component/s: Dependencies
• Platform: All
• Assignee: Unassigned
• Reporter: Jackson Fleming
• Created: 22/May/24 06:01
• Updated: 24/May/24 11:29

Description

There's a dependency in Cassandra project on an old version of the Java driver cassandra-driver-core - 3.11.0 in the 4.0 and later releases of Cassandra 

 

(For example on the 4.1 branch https://github.com/apache/cassandra/blob/cassandra-4.1/build.xml#L691) 

 

It appears that this dependency may have some security vulnerabilities in transitive dependencies.

But also this is a very old version of the driver, ideally it would be aligned to a newer version, I would suggest either 3.11.5 which is the latest in that line of driver versions https://mvnrepository.com/artifact/com.datastax.cassandra/cassandra-driver-core

or this gets updated to the latest 4.x driver (as of writing that's 4.18.1 in https://mvnrepository.com/artifact/org.apache.cassandra/java-driver-core ) but this seems like a larger undertaking.