You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "NamanKu-tech (via GitHub)" <gi...@apache.org> on 2026/05/02 18:52:01 UTC
[PR] Bump kafka-clients to 3.9.1 to fix SASL auth failure on JDK 24+ (#13849) [skywalking]
NamanKu-tech opened a new pull request, #13859:
URL: https://github.com/apache/skywalking/pull/13859
<!--
β οΈ Please make sure to read this template first, pull requests that don't accord with this template
maybe closed without notice.
Texts surrounded by `<` and `>` are meant to be replaced by you, e.g. <framework name>, <issue number>.
Put an `x` in the `[ ]` to mark the item as CHECKED. `[x]`
-->
### Fix #13849: kafka-clients SASL authentication failure on JDK 24+
JDK 24 permanently disabled `Subject.getSubject(AccessControlContext)` (JEP 486, see KAFKA-18866).
`kafka-clients 3.4.0` calls this method during SASL authentication, causing OAP to crash
at startup when `kafka-fetcher` is configured with a SASL security protocol.
Bumping to `kafka-clients 3.9.1` which includes KAFKA-17078 β a reflective shim that
dispatches between `Subject.callAs/current` (JDK 18+) and `Subject.doAs/getSubject` (JDK 11-17),
making it work on JDK 11 through 25 with a single jar.
- [ ] Add a unit test to verify that the fix works.
- [x] Explain briefly why the bug exists and how to fix it.
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist π ====
### Improve the performance of <class or module or ...>
- [ ] Add a benchmark for the improvement, refer to [the existing ones](https://github.com/apache/skywalking/blob/master/apm-commons/apm-datacarrier/src/test/java/org/apache/skywalking/apm/commons/datacarrier/LinkedArrayBenchmark.java)
- [ ] The benchmark result.
```text
<Paste the benchmark results here>
```
- [ ] Links/URLs to the theory proof or discussion articles/blogs. <links/URLs here>
==== π Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist π ==== -->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ====
### <Feature description>
- [ ] If this is non-trivial feature, paste the links/URLs to the design doc.
- [ ] Update the documentation to include this new feature.
- [ ] Tests(including UT, IT, E2E) are added to verify the new feature.
- [ ] If it's UI related, attach the screenshots below.
==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ==== -->
- [x] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #13849.
- [x] Update the [`CHANGES` log](https://github.com/apache/skywalking/blob/master/docs/en/changes/changes.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump kafka-clients to 3.9.1 to fix SASL auth failure on JDK 24+ (#13849) [skywalking]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng closed pull request #13859: Bump kafka-clients to 3.9.1 to fix SASL auth failure on JDK 24+ (#13849)
URL: https://github.com/apache/skywalking/pull/13859
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump kafka-clients to 3.9.1 to fix SASL auth failure on JDK 24+ (#13849) [skywalking]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13859:
URL: https://github.com/apache/skywalking/pull/13859#discussion_r3177343206
##########
docs/en/changes/changes.md:
##########
@@ -2,6 +2,7 @@
#### Project
+* Bump `kafka-clients` from 3.4.0 to 3.9.1 to fix SASL authentication failure on JDK 24+ (JEP 486 removed `Subject.getSubject`; fix included in kafka-clients 3.9.1 via KAFKA-17078).
Review Comment:
The changelog says JEP 486 "removed" `Subject.getSubject`, but the JDK 24+ behavior is that the method is still present and now throws `UnsupportedOperationException` (i.e., itβs disabled). Consider rewording to avoid implying the API was deleted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump kafka-clients to 3.9.1 to fix SASL auth failure on JDK 24+ (#13849) [skywalking]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng commented on PR #13859:
URL: https://github.com/apache/skywalking/pull/13859#issuecomment-4365139340
You should update the license file. And e2e don't have e2e to verify this, so, we are not sure the dependency upgrade, but the compatibility is uncertain.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org