Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Initialize file configuration #5399
Initialize file configuration #5399
Changes from 4 commits
035b854
5366a07
908256b
7fa20aa
7a2db44
a7e944c
c2b7370
2b0e475
d77b1c1
55f3829
4e87de1
d9b0350
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Will this eventually make jackson a hard dependency for the sdk or just this extension?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
jackson-databind
gets CVEs very often, I'd sleep better if we don't include it in the SDK (at some point); wouldjackson-jr
be able to handle the generated POJOs?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This would likely eventually be merged into the autoconfigure module, rather than the SDK itself.
I can investigate
jackson-jr
.Also, there's the more hands on option of doing something like we do with YAML view configuration, where we use snake YAML to parse to a generic type, then extract the fields manually. Maybe we use jackson-databind / jackson-jr to prototype, and consider switching to the manual method when its looking more complete.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Considering this is for configuration, which is likely only done at startup I feel we should go with a potentially less performant option and not use jackson in exchange for fewer dependencies and CVE exposure.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's less of the performance I'm worried about and more the additional complexity to manually do the parsing that jackson does automatically. Additionally, there is likely to be a fair amount of churn in the early versions of the configuration schema - I'm happy enough writing manual parsing code once, but won't sign up to rewrite the manual parsing code for each of the early iterations.