Open
Description
Describe the bug
We should investigate what exactly is in each release artifact and why they exist, to see if we can reduce the number (and avoid confusion). cough shaded-all cough
Old Description:
There are some confusing dependencies. For example, clickhouse-jdbc
(https://mvnrepository.com/artifact/com.clickhouse/clickhouse-jdbc) has:
com.clickhouse » org.apache.commons.compress
1.9.2com.clickhouse » io.grpc
1.9.2com.clickhouse » org.roaringbitmap
1.9.2
What confuses:
- version.
- org.apache.commons.compress - this package had vulnerabilities in early versions