Just curious why the Kafka version was updated in the latest release 3.3.14

[ccwillia]

The latest 3.x Kafka version released is 3.9.2 which resolves the lz4 vulnerability identified last fall

[sobychacko]

@ccwillia I think you are asking why we haven't updated the Kafka client to 3.9.2 in the latest release 3.3.14. The reason is that we cannot update kafka client to a new minor version once we are settled on a minor in Spring Kafka. For the 3.3.x line, we originally released it with 3.8.x Kafka clients, and then in mid-stream we can't upgrade that to 3.9.x. For that, we would have needed another new minor on Spring Kafka, something like 3.4.x which we decided not to do since we had to focus on 4.0.x. However, here is the thing - Spring Kafka 3.3.x is compatible with both Kafka client versions 3.8.x and 3.9.x. Therefore, although by default you get 3.8.1 kafka client, you can just override that to 3.9.2 in your application and still get the lz4 vulnerability fix you mentioned.

In fact, if you are a Spring Boot user, when you use Spring Boot 3.5, you get Spring Kafka 3.3.14 and kafka client 3.9.2.