You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "averemee-si (via GitHub)" <gi...@apache.org> on 2026/03/31 12:30:17 UTC

[PR] KAFKA-20373 [kafka]

averemee-si opened a new pull request, #21911:
URL: https://github.com/apache/kafka/pull/21911

   exclude plexus-utils-* from runtime jar's to fix [CVE-2025-67030](https://www.cve.org/CVERecord?id=CVE-2025-67030).
   Ref.: [KAFKA-20373](https://issues.apache.org/jira/browse/KAFKA-20373)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "averemee-si (via GitHub)" <gi...@apache.org>.
averemee-si commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4237639654

   Hi @FrankYang0529 
   
   I added an exclude statement to all "copyDependantLibs" tasks for plexus-utils*.jar but "Verify license file" failed with
   
   ```
   The following libs (from ./libs) are missing in the LICENSE file. These should be added to the LICENSE-binary file:
    - plexus-utils-3.6.0
   ```
   
   Looking into it


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4243564315

   @averemee-si please fix the license error
   ```
   The following libs (from ./libs) are missing in the LICENSE file. These should be added to the LICENSE-binary file:
    - plexus-utils-3.6.0
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: Bump maven artifact to 3.9.15 [kafka]

Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4270512725

   Applied to:
   - 4.3: https://github.com/apache/kafka/commit/df5748c6c14dfb8bd3be93a47a5a089b9aeec809
   - 4.2: https://github.com/apache/kafka/commit/c782ceecb2f18935f17a162dabb1957f50fdf665


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373 [kafka]

Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4173710307

   please fix the title ...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4203732441

   A label of 'needs-attention' was automatically added to this PR in order to raise the
   attention of the committers. Once this issue has been triaged, the `triage` label
   should be removed to prevent this automation from happening again.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "FrankYang0529 (via GitHub)" <gi...@apache.org>.
FrankYang0529 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4236283889

   @averemee-si Could you fix the CI error? Thank you.
   
   https://github.com/apache/kafka/actions/runs/23797355175/job/71074413471?pr=21911


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: Bump maven artifact to 3.9.15 [kafka]

Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison merged PR #21911:
URL: https://github.com/apache/kafka/pull/21911


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "averemee-si (via GitHub)" <gi...@apache.org>.
averemee-si commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4269201266

   Hi @FrankYang0529
   I will try to remove my exclusion and upgrade mavenArtifact to 3.9.15 later today


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "averemee-si (via GitHub)" <gi...@apache.org>.
averemee-si commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4243438114

   Hi @FrankYang0529
   
   Thanks for the advice. I will check locally later today


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "FrankYang0529 (via GitHub)" <gi...@apache.org>.
FrankYang0529 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4258191075

   @chia7712 @mimaison I think we can wait for maven 3.9.15. It bumps plexus-utils to 3.6.1 which can solve the CVE.
   
   https://github.com/apache/maven/blob/maven-3.9.15/pom.xml
   
   Based on their previous release 3.9.14, they had [vote thread](https://lists.apache.org/thread/9wwlcdrh4908yxxd8wmwq3ycv4wvzy80) on 03/09 and [announced release](https://lists.apache.org/thread/0cv49n8ndrn2zk2zkxhpvqw49nj3zrl1) on 03/12. They just started a [vote thread for 3.9.15](https://lists.apache.org/thread/3nkxdxnzpvs6vrpf3dmrxypr06zmstnq) on 04/14, so I think we can wait for it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4258726248

   Yes that timeline would work for 4.3.0


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4245202203

   > If we apply the change I suggested, we don't need plexus-utils-3.6.0 in LICENSE-binary.
   
   Did you mean to exclude plexus-utils from the distribution? If so, since it's used by maven-artifact in production, I'm not sure how it would work if we exclude it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "FrankYang0529 (via GitHub)" <gi...@apache.org>.
FrankYang0529 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4243590472

   > @averemee-si please fix the license error
   > 
   > ```
   > The following libs (from ./libs) are missing in the LICENSE file. These should be added to the LICENSE-binary file:
   >  - plexus-utils-3.6.0
   > ```
   
   @chia7712 If we apply the change I suggested, we don't need plexus-utils-3.6.0 in LICENSE-binary.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "FrankYang0529 (via GitHub)" <gi...@apache.org>.
FrankYang0529 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4268919817

   @averemee-si could you update `mavenArtifact` to `3.9.15` today? So I can run 4.2.1 RC release in the weekend? Thank you.
   
   https://lists.apache.org/thread/ym4d4tk65xs3xxj6ytwvz9vxd71nkr54


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: Bump maven artifact to 3.9.15 [kafka]

Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4269949860

   @averemee-si would you mind updating the PR description accordingly 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "averemee-si (via GitHub)" <gi...@apache.org>.
averemee-si commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4269397063

   Hi @FrankYang0529,
   
   Done.
   Happy releasing!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4249008404

   A label of 'needs-attention' was automatically added to this PR in order to raise the
   attention of the committers. Once this issue has been triaged, the `triage` label
   should be removed to prevent this automation from happening again.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20373: exclude plexus-utils-* from runtime jar's to fix CVE-2025-67030 [kafka]

Posted by "FrankYang0529 (via GitHub)" <gi...@apache.org>.
FrankYang0529 commented on PR #21911:
URL: https://github.com/apache/kafka/pull/21911#issuecomment-4243341797

   @averemee-si Could you change to use following code to exclude plexus-utils?
   
   ```
       implementation (libs.mavenArtifact) {
         exclude group: 'org.codehaus.plexus', module: 'plexus-utils'
       }
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org