KAFKA-3227; Conservative update of Kafka dependencies

[ijuma]

Patch version bumps for bouncy castle, minikdc, snappy, slf4j, scalatest and powermock. Notable fixes:

• Snappy: fixes a resource leak
• Bouncy castle: security fixes

Also update Gradle to 2.11 (where the notable change is improved IDE integration) and the grgit build dependency.

[granthenke]

Should Zookeeper bump to 3.4.7?

[ijuma]

No, 3.4.7 was pulled due to a deadlock.

[granthenke]

Ah right. Linking the jira: ZOOKEEPER-2347

[granthenke]

@ijuma Thanks for keeping the dependencies up to date. I check for dependency updates for my gradle projects (and checked this patch) with the below addition to my gradle file. Think that would be useful to add in a patch? If not, its useful to copy & paste when reviewing dependencies.

buildscript {
  repositories {
    jcenter()
    mavenCentral()
  }
  dependencies {
    classpath 'com.github.ben-manes:gradle-versions-plugin:0.12.0'
  }
}

subprojects {
  apply plugin: 'com.github.ben-manes.versions'

  dependencyUpdates {
    revision="release"
    resolutionStrategy = {
      componentSelection { rules ->
        rules.all { ComponentSelection selection ->
          boolean rejected = ['snap', 'alpha', 'beta', 'rc', 'cr', 'm'].any { qualifier ->
            selection.candidate.version ==~ /(?i).*[.-]${qualifier}[.\d-]*/
          }
          if (rejected) {
            selection.reject('Release candidate')
          }
        }
      }
    }
  }
}

gradle dependencyUpdates

[ijuma]

Thanks for the review @granthenke. I used something similar to your example to check the updates myself (although yours includes an additional rule that looks useful). I would personally find it useful, if that was included in the Kafka build.

[granthenke]

@ijuma Looking at the dependencies output I think commons-collections 3.2.1 is still pulled in transitively. Looks like the Hadoop update didn't fix miniKdc.

[ijuma]

@granthenke It looks like the hadoop project updated its commons-collections dependency to 3.2.2[1], but MiniKDC actually has no direct dependency on commons-collections, just a transitive one. So that commit didn't fix the issue in the end. Seems like we need #564 after all.

[1] apache/hadoop@1752fec

[granthenke]

@ijuma I can re-open it if you like. Its not a huge deal since its a test dependency.

This patch LGTM.

[ijuma]

Up to you @granthenke, I think rat also seems to have a dependency on common-collections. And thanks for the review!

[granthenke]

@ijuma That reminds me. The build script depends on an old version of grgit due to 1.6 compatibility, now that we don't need that can we update here too? (and use standard syntax)

From:
classpath group: 'org.ajoberstar', name: 'grgit', version: '0.2.3'

To:
classpath "org.ajoberstar:grgit:1.5.0"

[ijuma]

@granthenke Updated grgit.

[granthenke]

LGTM

[ijuma]

Review by @gwenshap or @ewencp

[ewencp]

LGTM