[fix][build] Remove jetty-server from avroTools Gradle configuration used in build#25784
Merged
lhotari merged 1 commit intoMay 15, 2026
Conversation
dao-jun
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
There are GitHub Dependabot security alerts about Jetty 9. The source of them is this build logic:
pulsar/pulsar-client/build.gradle.kts
Lines 90 to 104 in a1613bc
This is used in pulsar-client's build to generate avro classes from the schema for tests.
The dependency enforcement solution in the Pulsar Gradle build doesn't apply to all Gradle configurations. It's only applied to
implementation(and configurations extendingimplementation).avroToolsis an independent configuration.Modifications
Exclude
jetty-serverdependency since it's not needed at all.