You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Gary Russell edited this page Dec 1, 2017
·
1 revision
JSON Deserializers and MessageConverters
In accordance with CVE-2017-4995, only classes in java.util and java.lang will be deserialized by default; to deserialize (trust) other packages, use the addTrustedPackages method on the deserializer or in a customized DefaultJackson2TypeMapper for the message converter.
For the JsonDeserializer, the packages can be provided in the Kafka consumer config in property JsonDeserializer.TRUSTED_PACKAGES.
Apache Kafka Streams 1.0.0
Since version 1.0.0, some Kafka Streams API has been renamed.
To align with that change, the Spring for Apache Kafka high level API for Streams has been changed to use a new API and renamed respectively.
The KStreamBuilderFactoryBean now is named StreamsBuilderFactoryBean and it now produces a StreamsBuilder instance instead of the deprecated KStreamBuilder.
The bean for the StreamsBuilderFactoryBean populated by the @EnableKafkaStreams process, has been renamed from the defaultKStreamBuilder to the defaultKafkaStreamsBuilder.
The global constant for that name is now KafkaStreamsDefaultConfiguration.DEFAULT_STREAMS_BUILDER_BEAN_NAME.