SDK dependencies
Dependencies of the SDK 2.88.6
The SDK has different sets of dependencies that are depended on by their respective different setups listed in the previous section:
- Scala 2.13:
The following are the complete lists of dependencies for each setup of the SDK 2.88.6. To prevent binary compatibility issues, try to align versions of your application's dependencies with the versions of these SDK dependencies. Note, the dependencies of batch and stream processing further depend on the pipeline environments listed in the next section.
SDK Dependencies for Batch Processing with Scala 2.13
| Group ID | Artifact ID | Version |
|---|---|---|
| at.yawk.lz4 | lz4-java | 1.10.2 |
| ch.qos.logback | logback-classic | 1.5.20 |
| ch.qos.logback | logback-core | 1.5.20 |
| com.esotericsoftware | kryo | 5.6.2 |
| com.fasterxml.jackson.core | jackson-annotations | 2.18.6 |
| com.fasterxml.jackson.core | jackson-core | 2.18.6 |
| com.fasterxml.jackson.core | jackson-databind | 2.18.6 |
| com.fasterxml.jackson.dataformat | jackson-dataformat-yaml | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-jdk8 | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-json-org | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-jsr310 | 2.18.6 |
| com.fasterxml.jackson.module | jackson-module-scala_2.13 | 2.18.6 |
| com.github.blemale | scaffeine_2.13 | 4.1.0 |
| com.github.plokhotnyuk.jsoniter-scala | jsoniter-scala-core_2.13 | 2.4.0 |
| com.github.plokhotnyuk.jsoniter-scala | jsoniter-scala-macros_2.13 | 2.4.0 |
| com.github.scopt | scopt_2.13 | 4.0.1 |
| com.github.tototoshi | scala-csv_2.13 | 1.3.6 |
| com.google.code.findbugs | jsr305 | 3.0.0 |
| com.google.code.gson | gson | 2.11.0 |
| com.google.errorprone | error_prone_annotations | 2.36.0 |
| com.google.guava | guava | 33.4.0-jre |
| com.google.j2objc | j2objc-annotations | 3.0.0 |
| com.google.protobuf | protobuf-java | 4.32.0 |
| com.google.protobuf | protobuf-java-util | 4.32.0 |
| com.here.platform | environment-batch_2.13 | 5.0.9 |
| com.squareup.okhttp3 | logging-interceptor | 4.12.0 |
| com.squareup.okhttp3 | okhttp | 4.12.0 |
| com.squareup.okio | okio | 3.6.0 |
| com.thesamet.scalapb | compilerplugin_2.13 | 1.0.0-alpha.3 |
| com.thesamet.scalapb | lenses_2.13 | 1.0.0-alpha.3 |
| com.thesamet.scalapb | scalapb-runtime_2.13 | 1.0.0-alpha.3 |
| com.thoughtworks.paranamer | paranamer | 2.8 |
| com.typesafe | config | 1.4.3 |
| com.typesafe | ssl-config-core_2.13 | 0.6.1 |
| commons-codec | commons-codec | 1.17.2 |
| commons-io | commons-io | 2.18.0 |
| commons-logging | commons-logging | 1.3.5 |
| cz.jirutka.rsql | rsql-parser | 2.1.0 |
| io.circe | circe-core_2.13 | 0.14.15 |
| io.circe | circe-generic_2.13 | 0.14.15 |
| io.circe | circe-parser_2.13 | 0.14.15 |
| io.dropwizard.metrics | metrics-core | 4.2.30 |
| io.netty | netty-all | 4.1.133.Final |
| io.netty | netty-buffer | 4.1.133.Final |
| io.netty | netty-common | 4.1.133.Final |
| io.netty | netty-handler | 4.1.133.Final |
| io.netty | netty-transport | 4.1.133.Final |
| io.netty | netty-transport-classes-epoll | 4.1.133.Final |
| io.netty | netty-transport-native-epoll | 4.1.132.Final |
| io.netty | netty-transport-native-unix-common | 4.1.133.Final |
| it.unimi.dsi | fastutil | 7.0.13 |
| joda-time | joda-time | 2.13.0 |
| net.java.dev.jna | jna | 5.9.0 |
| net.jcip | jcip-annotations | 1.0 |
| nl.grons | metrics4-scala_2.13 | 4.0.7 |
| org.apache.commons | commons-lang3 | 3.17.0 |
| org.apache.commons | commons-math3 | 3.6.1 |
| org.apache.curator | curator-client | 5.7.1 |
| org.apache.curator | curator-framework | 5.7.1 |
| org.apache.curator | curator-recipes | 5.7.1 |
| org.apache.httpcomponents | httpclient | 4.5.14 |
| org.apache.httpcomponents | httpcore | 4.4.16 |
| org.apache.mesos | mesos | 1.11.0 |
| org.apache.pekko | pekko-actor_2.13 | 1.1.2 |
| org.apache.pekko | pekko-http-core_2.13 | 1.1.0 |
| org.apache.pekko | pekko-http_2.13 | 1.1.0 |
| org.apache.pekko | pekko-protobuf-v3_2.13 | 1.1.2 |
| org.apache.pekko | pekko-slf4j_2.13 | 1.1.2 |
| org.apache.pekko | pekko-stream_2.13 | 1.1.2 |
| org.apache.zookeeper | zookeeper | 3.9.5 |
| org.checkerframework | checker-qual | 3.43.0 |
| org.clapper | grizzled-slf4j_2.13 | 1.3.4 |
| org.jetbrains.kotlin | kotlin-stdlib-jdk8 | 1.9.10 |
| org.jline | jline | 3.27.1 |
| org.joda | joda-convert | 1.9.2 |
| org.json | json | 20240303 |
| org.json4s | json4s-ast_2.13 | 4.0.7 |
| org.json4s | json4s-core_2.13 | 4.0.7 |
| org.json4s | json4s-native_2.13 | 4.0.7 |
| org.locationtech.jts | jts-core | 1.18.2 |
| org.objenesis | objenesis | 3.4 |
| org.reactivestreams | reactive-streams | 1.0.4 |
| org.scala-lang | scala-compiler | 2.13.16 |
| org.scala-lang | scala-library | 2.13.16 |
| org.scala-lang | scala-reflect | 2.13.16 |
| org.scala-lang | scalap | 2.13.16 |
| org.scala-lang.modules | scala-collection-compat_2.13 | 2.7.0 |
| org.scala-lang.modules | scala-java8-compat_2.13 | 1.0.2 |
| org.scala-lang.modules | scala-parser-combinators_2.13 | 2.4.0 |
| org.scala-lang.modules | scala-xml_2.13 | 2.3.0 |
| org.slf4j | jcl-over-slf4j | 2.0.16 |
| org.slf4j | jul-to-slf4j | 2.0.16 |
| org.slf4j | log4j-over-slf4j | 2.0.16 |
| org.slf4j | slf4j-api | 2.0.16 |
| org.slf4j | slf4j-nop | 2.0.16 |
| org.slf4j | slf4j-reload4j | 2.0.16 |
| org.slf4j | slf4j-simple | 2.0.16 |
| org.xerial.snappy | snappy-java | 1.1.10.7 |
| org.yaml | snakeyaml | 2.3 |
SDK Dependencies for Stream Processing with Scala 2.13
| Group ID | Artifact ID | Version |
|---|---|---|
| at.yawk.lz4 | lz4-java | 1.10.2 |
| ch.qos.logback | logback-classic | 1.5.20 |
| ch.qos.logback | logback-core | 1.5.20 |
| com.esotericsoftware | kryo | 5.6.2 |
| com.fasterxml.jackson.core | jackson-annotations | 2.18.6 |
| com.fasterxml.jackson.core | jackson-core | 2.18.6 |
| com.fasterxml.jackson.core | jackson-databind | 2.18.6 |
| com.fasterxml.jackson.dataformat | jackson-dataformat-yaml | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-jdk8 | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-json-org | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-jsr310 | 2.18.6 |
| com.fasterxml.jackson.module | jackson-module-scala_2.13 | 2.18.6 |
| com.github.blemale | scaffeine_2.13 | 4.1.0 |
| com.github.luben | zstd-jni | 1.5.6-2 |
| com.github.plokhotnyuk.jsoniter-scala | jsoniter-scala-core_2.13 | 2.4.0 |
| com.github.plokhotnyuk.jsoniter-scala | jsoniter-scala-macros_2.13 | 2.4.0 |
| com.github.scopt | scopt_2.13 | 4.0.1 |
| com.github.tototoshi | scala-csv_2.13 | 1.3.6 |
| com.google.code.findbugs | jsr305 | 3.0.0 |
| com.google.code.gson | gson | 2.11.0 |
| com.google.errorprone | error_prone_annotations | 2.36.0 |
| com.google.guava | guava | 33.4.0-jre |
| com.google.j2objc | j2objc-annotations | 3.0.0 |
| com.google.protobuf | protobuf-java | 4.32.0 |
| com.google.protobuf | protobuf-java-util | 4.32.0 |
| com.here.platform | environment-stream | 7.0.0 |
| com.squareup.okhttp3 | logging-interceptor | 4.12.0 |
| com.squareup.okhttp3 | okhttp | 4.12.0 |
| com.squareup.okio | okio | 3.6.0 |
| com.thesamet.scalapb | compilerplugin_2.13 | 1.0.0-alpha.3 |
| com.thesamet.scalapb | lenses_2.13 | 1.0.0-alpha.3 |
| com.thesamet.scalapb | scalapb-runtime_2.13 | 1.0.0-alpha.3 |
| com.thoughtworks.paranamer | paranamer | 2.8 |
| com.twitter | chill-protobuf | 0.10.0 |
| com.typesafe | config | 1.4.3 |
| com.typesafe | ssl-config-core_2.13 | 0.6.1 |
| commons-codec | commons-codec | 1.17.2 |
| commons-io | commons-io | 2.18.0 |
| commons-logging | commons-logging | 1.3.5 |
| cz.jirutka.rsql | rsql-parser | 2.1.0 |
| io.airlift | aircompressor | 2.0.3 |
| io.circe | circe-core_2.13 | 0.14.15 |
| io.circe | circe-generic_2.13 | 0.14.15 |
| io.circe | circe-parser_2.13 | 0.14.15 |
| io.dropwizard.metrics | metrics-core | 4.2.30 |
| io.netty | netty-all | 4.1.133.Final |
| io.netty | netty-buffer | 4.1.133.Final |
| io.netty | netty-common | 4.1.133.Final |
| io.netty | netty-handler | 4.1.133.Final |
| io.netty | netty-transport | 4.1.133.Final |
| io.netty | netty-transport-classes-epoll | 4.1.133.Final |
| io.netty | netty-transport-native-epoll | 4.1.132.Final |
| io.netty | netty-transport-native-unix-common | 4.1.133.Final |
| it.unimi.dsi | fastutil | 7.0.13 |
| joda-time | joda-time | 2.9.3 |
| joda-time | joda-time | 2.13.0 |
| net.java.dev.jna | jna | 5.9.0 |
| net.jcip | jcip-annotations | 1.0 |
| nl.grons | metrics4-scala_2.13 | 4.0.7 |
| org.apache.avro | avro | 1.11.5 |
| org.apache.commons | commons-lang3 | 3.18.0 |
| org.apache.commons | commons-math3 | 3.6.1 |
| org.apache.curator | curator-client | 5.7.1 |
| org.apache.curator | curator-framework | 5.7.1 |
| org.apache.curator | curator-recipes | 5.7.1 |
| org.apache.httpcomponents | httpclient | 4.5.14 |
| org.apache.httpcomponents | httpcore | 4.4.16 |
| org.apache.mesos | mesos | 1.11.0 |
| org.apache.parquet | parquet-avro | 1.15.2 |
| org.apache.pekko | pekko-actor_2.13 | 1.1.2 |
| org.apache.pekko | pekko-http-core_2.13 | 1.1.0 |
| org.apache.pekko | pekko-http_2.13 | 1.1.0 |
| org.apache.pekko | pekko-protobuf-v3_2.13 | 1.1.2 |
| org.apache.pekko | pekko-slf4j_2.13 | 1.1.2 |
| org.apache.pekko | pekko-stream_2.13 | 1.1.2 |
| org.apache.zookeeper | zookeeper | 3.9.5 |
| org.checkerframework | checker-qual | 3.43.0 |
| org.clapper | grizzled-slf4j_2.13 | 1.3.4 |
| org.flinkextended | flink-scala-api-2_2.13 | 2.2.0 |
| org.jetbrains.kotlin | kotlin-stdlib-jdk8 | 1.9.10 |
| org.jline | jline | 3.27.1 |
| org.joda | joda-convert | 1.9.2 |
| org.json | json | 20240303 |
| org.json4s | json4s-ast_2.13 | 4.0.7 |
| org.json4s | json4s-core_2.13 | 4.0.7 |
| org.json4s | json4s-native_2.13 | 4.0.7 |
| org.locationtech.jts | jts-core | 1.18.2 |
| org.lz4 | lz4-java | 1.8.0 |
| org.objenesis | objenesis | 3.4 |
| org.reactivestreams | reactive-streams | 1.0.4 |
| org.scala-lang | scala-compiler | 2.13.16 |
| org.scala-lang | scala-library | 2.13.16 |
| org.scala-lang | scala-reflect | 2.13.16 |
| org.scala-lang | scalap | 2.13.16 |
| org.scala-lang.modules | scala-collection-compat_2.13 | 2.7.0 |
| org.scala-lang.modules | scala-java8-compat_2.13 | 1.0.2 |
| org.scala-lang.modules | scala-parser-combinators_2.13 | 2.4.0 |
| org.scala-lang.modules | scala-xml_2.13 | 2.3.0 |
| org.slf4j | jcl-over-slf4j | 2.0.16 |
| org.slf4j | jul-to-slf4j | 2.0.16 |
| org.slf4j | log4j-over-slf4j | 2.0.16 |
| org.slf4j | slf4j-api | 2.0.16 |
| org.slf4j | slf4j-nop | 2.0.16 |
| org.slf4j | slf4j-reload4j | 2.0.16 |
| org.slf4j | slf4j-simple | 2.0.16 |
| org.xerial.snappy | snappy-java | 1.1.10.7 |
| org.yaml | snakeyaml | 2.3 |
Known vulnerabilities
There are the following known vulnerabilities in the sdk-dep-stream_2.13:
| Library | Vulnerabilities | Notes |
|---|---|---|
| org.lz4/lz4-java:1.8.0 | CVE-2025-12183 CVE-2025-66566 |
SDK Dependencies for usage in Standalone mode with Scala 2.13
| Group ID | Artifact ID | Version |
|---|---|---|
| at.yawk.lz4 | lz4-java | 1.10.2 |
| ch.qos.logback | logback-classic | 1.5.20 |
| ch.qos.logback | logback-core | 1.5.20 |
| com.esotericsoftware | kryo | 5.6.2 |
| com.fasterxml.jackson.core | jackson-annotations | 2.18.6 |
| com.fasterxml.jackson.core | jackson-core | 2.18.6 |
| com.fasterxml.jackson.core | jackson-databind | 2.18.6 |
| com.fasterxml.jackson.dataformat | jackson-dataformat-yaml | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-jdk8 | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-json-org | 2.18.6 |
| com.fasterxml.jackson.datatype | jackson-datatype-jsr310 | 2.18.6 |
| com.fasterxml.jackson.module | jackson-module-scala_2.13 | 2.18.6 |
| com.github.blemale | scaffeine_2.13 | 4.1.0 |
| com.github.luben | zstd-jni | 1.5.6-2 |
| com.github.plokhotnyuk.jsoniter-scala | jsoniter-scala-core_2.13 | 2.4.0 |
| com.github.plokhotnyuk.jsoniter-scala | jsoniter-scala-macros_2.13 | 2.4.0 |
| com.github.scopt | scopt_2.13 | 4.0.1 |
| com.github.tototoshi | scala-csv_2.13 | 1.3.6 |
| com.google.code.findbugs | jsr305 | 3.0.0 |
| com.google.code.gson | gson | 2.11.0 |
| com.google.errorprone | error_prone_annotations | 2.36.0 |
| com.google.guava | guava | 33.4.0-jre |
| com.google.j2objc | j2objc-annotations | 3.0.0 |
| com.google.protobuf | protobuf-java | 4.32.0 |
| com.google.protobuf | protobuf-java-util | 4.32.0 |
| com.squareup.okhttp3 | logging-interceptor | 4.12.0 |
| com.squareup.okhttp3 | okhttp | 4.12.0 |
| com.squareup.okio | okio | 3.6.0 |
| com.thesamet.scalapb | compilerplugin_2.13 | 1.0.0-alpha.3 |
| com.thesamet.scalapb | lenses_2.13 | 1.0.0-alpha.3 |
| com.thesamet.scalapb | scalapb-runtime_2.13 | 1.0.0-alpha.3 |
| com.thoughtworks.paranamer | paranamer | 2.8 |
| com.typesafe | config | 1.4.3 |
| com.typesafe | ssl-config-core_2.13 | 0.6.1 |
| commons-beanutils | commons-beanutils | 1.11.0 |
| commons-codec | commons-codec | 1.17.2 |
| commons-io | commons-io | 2.18.0 |
| commons-logging | commons-logging | 1.3.5 |
| cz.jirutka.rsql | rsql-parser | 2.1.0 |
| io.airlift | aircompressor | 2.0.3 |
| io.circe | circe-core_2.13 | 0.14.15 |
| io.circe | circe-generic_2.13 | 0.14.15 |
| io.circe | circe-parser_2.13 | 0.14.15 |
| io.dropwizard.metrics | metrics-core | 4.2.30 |
| io.netty | netty-all | 4.1.133.Final |
| io.netty | netty-buffer | 4.1.133.Final |
| io.netty | netty-common | 4.1.133.Final |
| io.netty | netty-handler | 4.1.133.Final |
| io.netty | netty-transport | 4.1.133.Final |
| io.netty | netty-transport-classes-epoll | 4.1.133.Final |
| io.netty | netty-transport-native-epoll | 4.1.132.Final |
| io.netty | netty-transport-native-unix-common | 4.1.133.Final |
| it.unimi.dsi | fastutil | 7.0.13 |
| joda-time | joda-time | 2.13.0 |
| net.java.dev.jna | jna | 5.9.0 |
| net.jcip | jcip-annotations | 1.0 |
| nl.grons | metrics4-scala_2.13 | 4.0.7 |
| org.apache.avro | avro | 1.11.5 |
| org.apache.commons | commons-lang3 | 3.17.0 |
| org.apache.commons | commons-math3 | 3.6.1 |
| org.apache.commons | commons-text | 1.13.0 |
| org.apache.curator | curator-client | 5.7.1 |
| org.apache.curator | curator-framework | 5.7.1 |
| org.apache.curator | curator-recipes | 5.7.1 |
| org.apache.hadoop | hadoop-client | 3.4.1 |
| org.apache.httpcomponents | httpclient | 4.5.14 |
| org.apache.httpcomponents | httpcore | 4.4.16 |
| org.apache.mesos | mesos | 1.11.0 |
| org.apache.parquet | parquet-avro | 1.15.2 |
| org.apache.pekko | pekko-actor_2.13 | 1.1.2 |
| org.apache.pekko | pekko-http-core_2.13 | 1.1.0 |
| org.apache.pekko | pekko-http_2.13 | 1.1.0 |
| org.apache.pekko | pekko-protobuf-v3_2.13 | 1.1.2 |
| org.apache.pekko | pekko-slf4j_2.13 | 1.1.2 |
| org.apache.pekko | pekko-stream_2.13 | 1.1.2 |
| org.apache.zookeeper | zookeeper | 3.9.5 |
| org.bouncycastle | bcprov-jdk18on | 1.84 |
| org.checkerframework | checker-qual | 3.43.0 |
| org.clapper | grizzled-slf4j_2.13 | 1.3.4 |
| org.codehaus.woodstox | stax2-api | 4.2.1 |
| org.jetbrains.kotlin | kotlin-stdlib-jdk8 | 1.9.10 |
| org.jline | jline | 3.27.1 |
| org.joda | joda-convert | 1.9.2 |
| org.json | json | 20240303 |
| org.json4s | json4s-ast_2.13 | 4.0.7 |
| org.json4s | json4s-core_2.13 | 4.0.7 |
| org.json4s | json4s-native_2.13 | 4.0.7 |
| org.locationtech.jts | jts-core | 1.18.2 |
| org.objenesis | objenesis | 3.4 |
| org.reactivestreams | reactive-streams | 1.0.4 |
| org.scala-lang | scala-compiler | 2.13.16 |
| org.scala-lang | scala-library | 2.13.16 |
| org.scala-lang | scala-reflect | 2.13.16 |
| org.scala-lang | scalap | 2.13.16 |
| org.scala-lang.modules | scala-collection-compat_2.13 | 2.7.0 |
| org.scala-lang.modules | scala-java8-compat_2.13 | 1.0.2 |
| org.scala-lang.modules | scala-parser-combinators_2.13 | 2.4.0 |
| org.scala-lang.modules | scala-xml_2.13 | 2.3.0 |
| org.slf4j | jcl-over-slf4j | 2.0.16 |
| org.slf4j | jul-to-slf4j | 2.0.16 |
| org.slf4j | log4j-over-slf4j | 2.0.16 |
| org.slf4j | slf4j-api | 2.0.16 |
| org.slf4j | slf4j-nop | 2.0.16 |
| org.slf4j | slf4j-reload4j | 2.0.16 |
| org.slf4j | slf4j-simple | 2.0.16 |
| org.xerial.snappy | snappy-java | 1.1.10.7 |
| org.yaml | snakeyaml | 2.3 |
Known vulnerabilities
There are the following known vulnerabilities in the sdk-dep-standalone_2.13:
| Library | Vulnerabilities | Notes |
|---|---|---|
| org.eclipse.jetty/jetty-http:9.4.53.v20231009 | CVE-2026-2332 | Transitive dependency from Hadoop 3.4.1. We cannot safely fix it at the moment since Hadoop depends on Jetty 9 APIs and upgrading Jetty to 12.x would introduce incompatible breaking changes. |