You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "harmadasg (via GitHub)" <gi...@apache.org> on 2026/07/21 16:13:21 UTC
[PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
harmadasg opened a new pull request, #22898:
URL: https://github.com/apache/kafka/pull/22898
KAFKA-20815 reported a security vulnerability on `jline-remote-telnet` 3.30.4. Kafka does not have a dependency on the mentioned package but actually uses the whole jline bundle which includes telnet related binaries too. Jline is only used for the metadata shell module which in turn only needs it for basic terminal functionality, there are no remote capabilities. This PR aims to remove the unnecessary jline dependencies and prevent false positive security vulnerability scan results about jline telnet/ssh.
The shell module only needs the `jline-reader` dependency which also pulls in transitive dependencies `jline-terminal` and `jline -native`.
As an additional benefit the change reduces binary size going from jline bunde (1.40 MB) to jline-reader + jline-terminal + jline-native (650 KB) ~ 55% saved
While at it the dependency version has been updated to the latest 3.x release
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison merged PR #22898:
URL: https://github.com/apache/kafka/pull/22898
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3629121185
##########
gradle/dependencies.gradle:
##########
@@ -72,7 +72,7 @@ versions += [
jetty: "12.0.34",
jersey: "3.1.10",
jgit: "7.6.0.202603022253-r",
- jline: "3.30.4",
+ jline: "3.30.15",
Review Comment:
3.30.16 was just released, and we just missed the bus 😆
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "harmadasg (via GitHub)" <gi...@apache.org>.
harmadasg commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3629273470
##########
gradle/dependencies.gradle:
##########
@@ -72,7 +72,7 @@ versions += [
jetty: "12.0.34",
jersey: "3.1.10",
jgit: "7.6.0.202603022253-r",
- jline: "3.30.4",
+ jline: "3.30.15",
Review Comment:
sure I can do it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3624345888
##########
LICENSE-binary:
##########
@@ -307,7 +307,7 @@ BSD 2-Clause
---------------------------------------
BSD 3-Clause
-- jline-3.30.4, see: licenses/jline-BSD-3-clause
+- jline-3.30.15, see: licenses/jline-BSD-3-clause
Review Comment:
This must contain the names of the JAR we ship. So we need:
- jline-native-3.30.15
- jline-reader-3.30.15
- jline-terminal-3.30.15
##########
LICENSE-binary:
##########
@@ -307,7 +307,7 @@ BSD 2-Clause
---------------------------------------
BSD 3-Clause
-- jline-3.30.4, see: licenses/jline-BSD-3-clause
+- jline-3.30.15, see: licenses/jline-BSD-3-clause
Review Comment:
This must contain the names of the JARs we ship. So we need:
- jline-native-3.30.15
- jline-reader-3.30.15
- jline-terminal-3.30.15
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3629242510
##########
gradle/dependencies.gradle:
##########
@@ -72,7 +72,7 @@ versions += [
jetty: "12.0.34",
jersey: "3.1.10",
jgit: "7.6.0.202603022253-r",
- jline: "3.30.4",
+ jline: "3.30.15",
Review Comment:
@harmadasg do you have time to file a patch so we can catch the next bus?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "apoorvmittal10 (via GitHub)" <gi...@apache.org>.
apoorvmittal10 commented on PR #22898:
URL: https://github.com/apache/kafka/pull/22898#issuecomment-5524250416
Cherry-picked to 4.2: https://github.com/apache/kafka/commit/7b2e8eded11916a4f462b29c7ee167b0a8ecaa9e
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "harmadasg (via GitHub)" <gi...@apache.org>.
harmadasg commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3630063168
##########
gradle/dependencies.gradle:
##########
@@ -72,7 +72,7 @@ versions += [
jetty: "12.0.34",
jersey: "3.1.10",
jgit: "7.6.0.202603022253-r",
- jline: "3.30.4",
+ jline: "3.30.15",
Review Comment:
@chia7712 I have opened https://github.com/apache/kafka/pull/22906, no danger of missing the bus this time 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "harmadasg (via GitHub)" <gi...@apache.org>.
harmadasg commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3624955523
##########
LICENSE-binary:
##########
@@ -307,7 +307,7 @@ BSD 2-Clause
---------------------------------------
BSD 3-Clause
-- jline-3.30.4, see: licenses/jline-BSD-3-clause
+- jline-3.30.15, see: licenses/jline-BSD-3-clause
Review Comment:
Thanks I fixed it in [1398ee4](https://github.com/apache/kafka/pull/22898/commits/1398ee437b1f9e9e2dc89f86fb5d1ab90cbde86d) and also verified it with the `committer-tools/verify_license.py` script
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-20815: Remove unnecessary jline deps and bump to latest 3.x [kafka]
Posted by "harmadasg (via GitHub)" <gi...@apache.org>.
harmadasg commented on code in PR #22898:
URL: https://github.com/apache/kafka/pull/22898#discussion_r3629225168
##########
gradle/dependencies.gradle:
##########
@@ -72,7 +72,7 @@ versions += [
jetty: "12.0.34",
jersey: "3.1.10",
jgit: "7.6.0.202603022253-r",
- jline: "3.30.4",
+ jline: "3.30.15",
Review Comment:
so close 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org