Skip to content

[fix][build] Remove jetty-server from avroTools Gradle configuration used in build#25784

Merged
lhotari merged 1 commit into
apache:masterfrom
lhotari:lh-exclude-jetty-9-in-avro-tool-build-config
May 15, 2026
Merged

[fix][build] Remove jetty-server from avroTools Gradle configuration used in build#25784
lhotari merged 1 commit into
apache:masterfrom
lhotari:lh-exclude-jetty-9-in-avro-tool-build-config

Conversation

@lhotari
Copy link
Copy Markdown
Member

@lhotari lhotari commented May 15, 2026

Motivation

There are GitHub Dependabot security alerts about Jetty 9. The source of them is this build logic:

// Generate Avro test classes from .avsc schema files
val avroTools by configurations.creating
dependencies {
avroTools("org.apache.avro:avro-tools:${libs.versions.avro.get()}")
}
val generateTestAvro by tasks.registering(JavaExec::class) {
val avscDir = file("src/test/resources/avro")
val outputDir = layout.buildDirectory.dir("generated-sources/avro-test")
inputs.dir(avscDir)
outputs.dir(outputDir)
classpath = avroTools
mainClass.set("org.apache.avro.tool.Main")
args("compile", "schema", avscDir.absolutePath, outputDir.get().asFile.absolutePath)
}

This is used in pulsar-client's build to generate avro classes from the schema for tests.

The dependency enforcement solution in the Pulsar Gradle build doesn't apply to all Gradle configurations. It's only applied to implementation (and configurations extending implementation). avroTools is an independent configuration.

Modifications

Exclude jetty-server dependency since it's not needed at all.

@lhotari lhotari merged commit f700874 into apache:master May 15, 2026
43 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants