[improve][build] Upgrade org.apache.kerby:kerb-simplekdc from 1.1.1 to 2.1.1#25785
Merged
Conversation
…o 2.1.1 Kerby 1.1.1 was released on May 25th, 2018 and pulls in some vulnerable transitive dependencies such as com.nimbusds:nimbus-jose-jwt 4.41.2. Upgrading to 2.1.1 brings in modern transitive dependencies (e.g. nimbus-jose-jwt 10.6). The kerb-simplekdc artifact is only used in pulsar-broker-auth-sasl tests (MiniKdc). The API surface used (SimpleKdcServer, KdcConfigKey, KrbException, IOUtil, NetworkUtil) is source-compatible between 1.1.1 and 2.1.1, so no code changes are required.
dao-jun
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
org.apache.kerby:kerb-simplekdcwas last bumped to1.1.1, which was released on May 25th, 2018. That release transitively pulls in some vulnerable dependencies, includingcom.nimbusds:nimbus-jose-jwt4.41.2.Kerby
2.1.1is the latest release and brings in modern, supported versions of its transitive dependencies (e.g.nimbus-jose-jwt10.6), in addition to several years of upstream bug fixes.Modifications
kerbyversion ingradle/libs.versions.tomlfrom1.1.1to2.1.1.The
kerb-simplekdcartifact is only used in test scope by thepulsar-broker-auth-saslmodule (MiniKdc.java). The API surface used byMiniKdc(SimpleKdcServer,KdcConfigKey,KrbException,org.apache.kerby.util.IOUtil,org.apache.kerby.util.NetworkUtil) is source-compatible between 1.1.1 and 2.1.1, so no production or test code changes are required.Verifying this change
This change is already covered by existing tests:
./gradlew :pulsar-broker-auth-sasl:test— all 11 tests pass (ProxySaslAuthenticationTest,SaslAuthenticateTest,SaslServerTokenSignerTest), which exercise the SASL/Kerberos flow backed by the embedded KerbySimpleKdcServerviaMiniKdc../gradlew spotlessCheck checkstyleMain checkstyleTest— clean.Does this pull request potentially affect one of the following parts:
This is a test-scope dependency upgrade (
kerb-simplekdcis only used bypulsar-broker-auth-sasltests), so there is no impact on runtime artifacts or deployment.