Skip to content

Commit d9fda26

Browse files
morazowclaude
morazow
and
claude
committed
[fs] Scope jetty exclusion to fluss-fs-azure and fix NOTICE
Only hadoop-azure actually bundles jetty (jetty-util / jetty-util-ajax) into the shaded FS jar; hadoop-aliyun (oss) and hadoop-huaweicloud (obs) do not pull jetty into the bundle, and jetty-http/server/servlet/webapp are never bundled. Trim the exclusions to the two artifacts that are really present and revert the no-op oss/obs changes. Also remove the now-stale jetty entries from the fluss-fs-azure NOTICE: the license-check CI only fails on bundled-but-unlisted dependencies, so a listed-but-unbundled entry stays green and had to be cleaned up by hand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 37cf57b commit d9fda26

4 files changed

Lines changed: 5 additions & 81 deletions

File tree

‎fluss-filesystems/fluss-fs-azure/pom.xml‎

Lines changed: 4 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -80,17 +80,10 @@
8080
<groupId>org.slf4j</groupId>
8181
<artifactId>slf4j-reload4j</artifactId>
8282
</exclusion>
83-
<!-- Jetty is only used by Hadoop's web UI server and the unused WASB native
84-
store; Fluss uses ABFS. Excluded to drop vulnerable jetty-http (CVE-2026-2332,
85-
CVE-2024-6763, CVE-2025-11143) and other transitive jetty 9.x jars. -->
86-
<exclusion>
87-
<groupId>org.eclipse.jetty</groupId>
88-
<artifactId>jetty-server</artifactId>
89-
</exclusion>
90-
<exclusion>
91-
<groupId>org.eclipse.jetty</groupId>
92-
<artifactId>jetty-http</artifactId>
93-
</exclusion>
83+
<!-- jetty-util(-ajax) is pulled in transitively by hadoop-azure but is only
84+
used by Hadoop's web UI server and the unused WASB native store; Fluss uses
85+
ABFS. Excluded to keep them off the bundled FS jar (also drops jetty 9.x
86+
CVEs as a side benefit). -->
9487
<exclusion>
9588
<groupId>org.eclipse.jetty</groupId>
9689
<artifactId>jetty-util</artifactId>
@@ -99,14 +92,6 @@
9992
<groupId>org.eclipse.jetty</groupId>
10093
<artifactId>jetty-util-ajax</artifactId>
10194
</exclusion>
102-
<exclusion>
103-
<groupId>org.eclipse.jetty</groupId>
104-
<artifactId>jetty-servlet</artifactId>
105-
</exclusion>
106-
<exclusion>
107-
<groupId>org.eclipse.jetty</groupId>
108-
<artifactId>jetty-webapp</artifactId>
109-
</exclusion>
11095
</exclusions>
11196
</dependency>
11297
<dependency>

‎fluss-filesystems/fluss-fs-azure/src/main/resources/META-INF/NOTICE‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -72,11 +72,4 @@ This project bundles the following dependencies under the MIT License (https://o
7272

7373
- org.checkerframework:checker-qual:2.5.2
7474
- org.codehaus.mojo:animal-sniffer-annotations:1.17
75-
- org.bouncycastle:bcprov-jdk15on:1.70
76-
77-
This project bundles the following dependencies under the Eclipse Public License 2.0 and Apache License 2.0 (dual license). See bundled license files for details.
78-
- EPL-2.0: https://www.eclipse.org/legal/epl-2.0/
79-
- Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
80-
81-
- org.eclipse.jetty:jetty-util-ajax:9.4.43.v20210629
82-
- org.eclipse.jetty:jetty-util:9.4.43.v20210629
75+
- org.bouncycastle:bcprov-jdk15on:1.70

‎fluss-filesystems/fluss-fs-obs/pom.xml‎

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -77,33 +77,6 @@
7777
<groupId>org.slf4j</groupId>
7878
<artifactId>slf4j-reload4j</artifactId>
7979
</exclusion>
80-
<!-- Jetty is only used by Hadoop's web UI server, never on the FS client path.
81-
Excluded to drop vulnerable jetty-http (CVE-2026-2332, CVE-2024-6763,
82-
CVE-2025-11143) and other transitive jetty 9.x jars. -->
83-
<exclusion>
84-
<groupId>org.eclipse.jetty</groupId>
85-
<artifactId>jetty-server</artifactId>
86-
</exclusion>
87-
<exclusion>
88-
<groupId>org.eclipse.jetty</groupId>
89-
<artifactId>jetty-http</artifactId>
90-
</exclusion>
91-
<exclusion>
92-
<groupId>org.eclipse.jetty</groupId>
93-
<artifactId>jetty-util</artifactId>
94-
</exclusion>
95-
<exclusion>
96-
<groupId>org.eclipse.jetty</groupId>
97-
<artifactId>jetty-util-ajax</artifactId>
98-
</exclusion>
99-
<exclusion>
100-
<groupId>org.eclipse.jetty</groupId>
101-
<artifactId>jetty-servlet</artifactId>
102-
</exclusion>
103-
<exclusion>
104-
<groupId>org.eclipse.jetty</groupId>
105-
<artifactId>jetty-webapp</artifactId>
106-
</exclusion>
10780
</exclusions>
10881
</dependency>
10982

‎fluss-filesystems/fluss-fs-oss/pom.xml‎

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -76,33 +76,6 @@
7676
<groupId>org.slf4j</groupId>
7777
<artifactId>slf4j-reload4j</artifactId>
7878
</exclusion>
79-
<!-- Jetty is only used by Hadoop's web UI server, never on the FS client path.
80-
Excluded to drop vulnerable jetty-http (CVE-2026-2332, CVE-2024-6763,
81-
CVE-2025-11143) and other transitive jetty 9.x jars. -->
82-
<exclusion>
83-
<groupId>org.eclipse.jetty</groupId>
84-
<artifactId>jetty-server</artifactId>
85-
</exclusion>
86-
<exclusion>
87-
<groupId>org.eclipse.jetty</groupId>
88-
<artifactId>jetty-http</artifactId>
89-
</exclusion>
90-
<exclusion>
91-
<groupId>org.eclipse.jetty</groupId>
92-
<artifactId>jetty-util</artifactId>
93-
</exclusion>
94-
<exclusion>
95-
<groupId>org.eclipse.jetty</groupId>
96-
<artifactId>jetty-util-ajax</artifactId>
97-
</exclusion>
98-
<exclusion>
99-
<groupId>org.eclipse.jetty</groupId>
100-
<artifactId>jetty-servlet</artifactId>
101-
</exclusion>
102-
<exclusion>
103-
<groupId>org.eclipse.jetty</groupId>
104-
<artifactId>jetty-webapp</artifactId>
105-
</exclusion>
10679
</exclusions>
10780
</dependency>
10881

0 commit comments

Comments
 (0)