harmadasg opened a new pull request, #22898: URL: https://github.com/apache/kafka/pull/22898
KAFKA-20815 reported a security vulnerability on `jline-remote-telnet` 3.30.4. Kafka does not have a dependency on the mentioned package but actually uses the whole jline bundle which includes telnet related binaries too. Jline is only used for the metadata shell module which in turn only needs it for basic terminal functionality, there are no remote capabilities. This PR aims to remove the unnecessary jline dependencies and prevent false positive security vulnerability scan results about jline telnet/ssh. The shell module only needs the `jline-reader` dependency which also pulls in transitive dependencies `jline-terminal` and `jline -native`. As an additional benefit the change reduces binary size going from jline bunde (1.40 MB) to jline-reader + jline-terminal + jline-native (650 KB) ~ 55% saved While at it the dependency version has been updated to the latest 3.x release -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
