From a92713c4ba4544e57a9690e3ef133ac29036382e Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr.github@karwasz.org>
Date: Tue, 24 Sep 2024 07:38:28 +0200
Subject: [PATCH] Pin Cassandra transitive deps

---
 log4j-cassandra/pom.xml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/log4j-cassandra/pom.xml b/log4j-cassandra/pom.xml
index a248ca734b3..eb914cf0e28 100644
--- a/log4j-cassandra/pom.xml
+++ b/log4j-cassandra/pom.xml
@@ -45,8 +45,29 @@
     <!-- cassandra-all breaks with a newer version -->
     <!-- at least this version has one CVE less than the one suggested by Cassandra -->
     <guava.version>25.1-jre</guava.version>
+    <!-- Pinned transitive dependencies for reproducibility between Linux and MacOS -->
+    <jnr-ffi.version>2.2.16</jnr-ffi.version>
+    <snappy.version>1.1.10.7</snappy.version>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+
+      <dependency>
+        <groupId>com.github.jnr</groupId>
+        <artifactId>jnr-ffi</artifactId>
+        <version>${jnr-ffi.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.xerial.snappy</groupId>
+        <artifactId>snappy-java</artifactId>
+        <version>${snappy.version}</version>
+      </dependency>
+
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.logging.log4j</groupId>