[
https://issues.apache.org/jira/browse/KAFKA-21299?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dejan Stojadinović updated KAFKA-21299:
---------------------------------------
Description:
(!) Note: this is also addressing security advisory: *Failure to disable
repositories failing to establish an SSL connection can expose builds to
malicious artifacts*
{quote}_When resolving dependencies, Gradle searches repositories in
declaration order. If it encounters connection errors, Gradle will disable the
repository and fail dependency resolution. This is necessary for both
reproducibility and security reasons to prevent dependencies from being
resolved from other repositories without warning._
{quote}
*Scope:*
* Upgrades Gradle from 9.7.1 to 9.8.2 ( ⚠️ addresses
[https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5])
* Fetches the Gradle wrapper jar from a pinned Gradle commit: because
{{v9.8.1}} tag contains a jar that doesn't match the published 9.8.1 checksum
{color:#ff0000}*Pitfall :*{color} Kafka trunk *wrapper.gradle* pins
*wrapperJarUrl* to a Gradle tag
("https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";)
that _*may*_ contain the wrapper JAR of the previous Gradle version (i.e.
release tag contains the bootstrap jar Gradle uses to build itself which may be
from the previous version and then doesn't match the published wrapper
checksum).
*Illustration: 16 Gradle 9.x.y versions share only 8 Wrapper JARs:*
* Gradle checksums: [https://gradle.org/release-checksums] (or
[https://services.gradle.org/distributions])
||Gradle version(s)||Wrapper JAR Checksum||
|9.8.1|3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98|
|9.8.0|238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5|
|9.7.1, 9.7.0|7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d|
|9.6.1, 9.6.0, 9.5.1,
9.5.0|497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7|
|9.4.1, 9.4.0|55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c|
|9.3.1, 9.3.0|b3a875ddc1f044746e1b1a55f645584505f4a10438c1afea9f15e92a7c42ec13|
|9.2.1, 9.2.0|423cb469ccc0ecc31f0e4e1c309976198ccb734cdcbb7029d4bda0f18f57e8d9|
|9.1.0, 9.0.0|76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3|
* Gradle wrapper jar git commits:
[https://github.com/gradle/gradle/commits/master/gradle/wrapper/gradle-wrapper.jar]
(please note that Gradle tag v9.8.1 doesn't contain commit
{color:#de350b}{_}*dcc5ee0ec88 Update to Gradle 9.8.1*{_}){color}:
{quote}dejan@home:~/gradle$ *date*
Mon 19 Oct 17:06:56 CEST 2026
dejan@home:~/gradle$ *git remote -v*
origin [https://github.com/gradle/gradle.git] (fetch)
origin [https://github.com/gradle/gradle.git] (push)
dejan@home:~/gradle$ *git log -1 --oneline*
39daf39feb6 (HEAD, tag: v9.8.1) Release notes for Gradle 9.8.1 (#39409)
dejan@home:~/gradle$ *git status*
HEAD detached at v9.8.1
nothing to commit, working tree clean
dejan@home:~/gradle$ *git log --no-abbrev --oneline -12 –
gradle/wrapper/gradle-wrapper.jar | git name-rev --tags --annotate-stdin*
{color:#0747a6}*7bb5f96fca01712ee94624fe67ded6a917e18bd8 (tags/v9.8.0-RC2~10^2)
Update Gradle wrapper to version release-candidate*{color}
8ed35c9985f7c44fe301708803038badf5e96434 (tags/v9.8.0-M2~13^2) Gradle 9.8.0 M1
17901347dad93f15ec0978dbef4c872d7d0d60a6 (tags/v9.7.0-RC2~14^2) Update Gradle
wrapper to version 9.7.0-rc-1
ae5c0f4c6e9171a779e434e8ef52a82d28a63537 (tags/v9.5.0-RC2~21^2) Update Gradle
wrapper to version 9.5.0-rc-1
112aba6448e9022e8539db08e80388c4e4895786 (tags/v9.5.0-RC1~35^2~27^2) Update
wrapper to 9.5.0-milestone-7
5c141fb9464c777ebebb3aa64fa8183294045528 (tags/v9.4.0-RC1~27^2) Update Gradle
wrapper to version release-milestone
11535f629124b74edcc669a8e70cdcde1411bda5 (tags/v9.4.0-M5~3^2~81^2) Update
wrapper to 9.4.0-milestone-4
308880bfbe2ce00713f2bbc821a6498062c43918 (tags/v9.4.0-M2~1^2) Upgradlew to
9.4.0-milestone-1
90638756ec0d38897216423df8447469baddd66e (tags/v9.4.0-M1~86^2~2) Update Gradle
to 9.3.0-milestone-1
16145458453db99eb65e9596c9ac238a1a38764a (tags/v9.2.0-RC2~17^2) Update Gradle
wrapper to version 9.2.0-rc-1
5f992e2737e4cfe20e0bc436a9b605cc460efcf0 (tags/v9.0.0-RC1~59^2~17^2~1) Update
Gradle to 9.0.0-milestone-9
d0e7e8baa15621f68070e863574e60b226bbaa2e (tags/v9.0.0-M7~23^2) Update Gradle to
9.0-milestone-6
dejan@home:~/gradle$ *git checkout master*
Previous HEAD position was 39daf39feb6 Release notes for Gradle 9.8.1 (#39409)
Switched to branch 'master'
Your branch is up-to-date with 'origin/master'.
dejan@home:~/gradle$ *git log -1 --oneline*
a279503d16d (HEAD -> master, origin/master, origin/HEAD) Merge release into
master (20261019) (#39491)
dejan@home:~/gradle$ *git log --no-abbrev --oneline -13 –
gradle/wrapper/gradle-wrapper.jar | git name-rev --tags --annotate-stdin*
{color:#ff0000}*dcc5ee0ec88270575344e6afd490f96d96f84ab3 Update to Gradle
9.8.1*{color}
{color:#0747a6}*7bb5f96fca01712ee94624fe67ded6a917e18bd8 (tags/v9.8.0-RC2~10^2)
Update Gradle wrapper to version release-candidate*{color}
8ed35c9985f7c44fe301708803038badf5e96434 (tags/v9.8.0-M2~13^2) Gradle 9.8.0 M1
17901347dad93f15ec0978dbef4c872d7d0d60a6 (tags/v9.7.0-RC2~14^2) Update Gradle
wrapper to version 9.7.0-rc-1
ae5c0f4c6e9171a779e434e8ef52a82d28a63537 (tags/v9.5.0-RC2~21^2) Update Gradle
wrapper to version 9.5.0-rc-1
112aba6448e9022e8539db08e80388c4e4895786 (tags/v9.5.0-RC1~35^2~27^2) Update
wrapper to 9.5.0-milestone-7
5c141fb9464c777ebebb3aa64fa8183294045528 (tags/v9.4.0-RC1~27^2) Update Gradle
wrapper to version release-milestone
11535f629124b74edcc669a8e70cdcde1411bda5 (tags/v9.4.0-M5~3^2~81^2) Update
wrapper to 9.4.0-milestone-4
308880bfbe2ce00713f2bbc821a6498062c43918 (tags/v9.4.0-M2~1^2) Upgradlew to
9.4.0-milestone-1
90638756ec0d38897216423df8447469baddd66e (tags/v9.4.0-M1~86^2~2) Update Gradle
to 9.3.0-milestone-1
16145458453db99eb65e9596c9ac238a1a38764a (tags/v9.2.0-RC2~17^2) Update Gradle
wrapper to version 9.2.0-rc-1
5f992e2737e4cfe20e0bc436a9b605cc460efcf0 (tags/v9.0.0-RC1~59^2~17^2~1) Update
Gradle to 9.0.0-milestone-9
d0e7e8baa15621f68070e863574e60b226bbaa2e (tags/v9.0.0-M7~23^2) Update Gradle to
9.0-milestone-6
dejan@home:~/gradle$ *date*
Mon 19 Oct 17:09:10 CEST 2026
dejan@home:~/gradle$
{quote}
{*}Related Gradle issue{*}:
[https://github.com/gradle/gradle/issues/39471#issuecomment-6189156726]
*How to reproduce wrapper related issue on Kafka side:*
# try to upgrade Gradle version from 9.7.1 to 9.8.1 (follow manual in
kafka/gradle/wrapper/README.md)
# try to execute Gradle command, for example: *./gradlew clean*
** every *odd* (1st, 3rd, 5th, etc) execution fails (x) with "Unable to access
jarfile" (the wrapper jar fails checksum verification and gets deleted)
** every *even* (2nd, 4th, 6th, etc) execution passes (on) (the wrapper jar is
downloaded again from the v9.8.1 tag and executed without verification)
*Upgrade process (taken from terminal):*
{code:java}
dejan@home:~/kafka$ date
Sat 17 Oct 12:31:32 CEST 2026
dejan@home:~/kafka$ git log -2 --oneline
65566690ca1 (HEAD -> Gradle-9.8.1-yet-another-try, upstream/trunk,
upstream/HEAD) MINOR: Don't block on position() when advancing standby restored
offsets (#23841)
59046aecc31 KAFKA-21289 Fix release.py stage-docs for Hugo kafka-site (#23833)
dejan@home:~/kafka$ git status
On branch Gradle-9.8.1-yet-another-try
nothing to commit, working tree clean
dejan@home:~/kafka$ git diff
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index d670f3658dd..e82ce56aafe 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -58,7 +58,7 @@ versions += [
commonsValidator: "1.11.0",
commonsNet: "3.13.0",
classgraph: "4.8.196",
- gradle: "9.7.1",
+ gradle: "9.8.1",
httpclient: "4.5.14",
jackson: "2.22.3",
jacksonAnnotations: "2.22",
diff --git a/wrapper.gradle b/wrapper.gradle
index 2f7a1dc3245..364ed15fb91 100644
--- a/wrapper.gradle
+++ b/wrapper.gradle
@@ -40,7 +40,7 @@ task bootstrapWrapper() {
// of curl (built against OpenSSL library that doesn't support
TLSv1.2) would fail to
// fetch the jar.
// IMPORTANT: This checksum **must** be updated whenever the Gradle
version changes.
- String wrapperChecksum =
"7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
+ String wrapperChecksum =
"3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
def wrapperJarUrl =
"https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";
def bootstrapString = """
dejan@home:~/kafka$ ./gradlew wrapper --gradle-version 9.8.1
--distribution-type bin --gradle-distribution-sha256-sum
dce76f55f8e251a3a1f130eb120f30b3d271de2b76c9b0729d316b5a1b6dc01f
> Configure project :
Starting build with version 4.5.0-SNAPSHOT (commit id 65566690) using Gradle
9.8.1, Java 17 and Scala 2.13.18
Build properties: ignoreFailures=false, maxParallelForks=8, maxScalacThreads=8,
maxTestRetries=0
[Incubating] Problems report is available at:
file:///home/dejan/kafka/build/reports/problems/problems-report.html
Deprecated Gradle features were used in this build, making it incompatible with
Gradle 10.
You can use '--warning-mode all' to show the individual deprecation warnings
and determine if they come from your own scripts or plugins.
For more on this, please refer to
https://docs.gradle.org/9.7.1/userguide/command_line_interface.html#sec:command_line_warnings
in the Gradle documentation.
BUILD SUCCESSFUL in 11s
9 actionable tasks: 9 executed
Consider enabling configuration cache to speed up this build:
https://docs.gradle.org/9.7.1/userguide/configuration_cache_enabling.html
dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
[Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
4 files changed, 6 insertions(+), 6 deletions(-)
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:15 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:28 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ date
Sat 17 Oct 12:34:41 CEST 2026
dejan@home:~/kafka$
{code}
*Every odd execution (1, 3, 5) fails while every even (2,4,6) execution starts
as expected:*
{code:java}
dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
[Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
4 files changed, 6 insertions(+), 6 deletions(-)
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:15 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:28 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ date
Sat 17 Oct 12:34:41 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ date
Sat 17 Oct 12:39:30 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ date
Sat 17 Oct 12:39:43 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$
{code}
was:
(!) Note: this is also addressing security advisory: *Failure to disable
repositories failing to establish an SSL connection can expose builds to
malicious artifacts*
{quote}_When resolving dependencies, Gradle searches repositories in
declaration order. If it encounters connection errors, Gradle will disable the
repository and fail dependency resolution. This is necessary for both
reproducibility and security reasons to prevent dependencies from being
resolved from other repositories without warning._
{quote}
*Scope:*
* Upgrades Gradle from 9.7.1 to 9.8.1 ( ⚠️ addresses
[https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5])
* Fetches the Gradle wrapper jar from a pinned Gradle commit: because
{{v9.8.1}} tag contains a jar that doesn't match the published 9.8.1 checksum
{color:#ff0000}*Pitfall :*{color} Kafka trunk *wrapper.gradle* pins
*wrapperJarUrl* to a Gradle tag
("https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";)
that _*may*_ contain the wrapper JAR of the previous Gradle version (i.e.
release tag contains the bootstrap jar Gradle uses to build itself which may be
from the previous version and then doesn't match the published wrapper
checksum).
*Illustration: 16 Gradle 9.x.y versions share only 8 Wrapper JARs:*
* Gradle checksums: [https://gradle.org/release-checksums] (or
[https://services.gradle.org/distributions])
||Gradle version(s)||Wrapper JAR Checksum||
|9.8.1|3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98|
|9.8.0|238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5|
|9.7.1, 9.7.0|7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d|
|9.6.1, 9.6.0, 9.5.1,
9.5.0|497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7|
|9.4.1, 9.4.0|55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c|
|9.3.1, 9.3.0|b3a875ddc1f044746e1b1a55f645584505f4a10438c1afea9f15e92a7c42ec13|
|9.2.1, 9.2.0|423cb469ccc0ecc31f0e4e1c309976198ccb734cdcbb7029d4bda0f18f57e8d9|
|9.1.0, 9.0.0|76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3|
* Gradle wrapper jar git commits:
[https://github.com/gradle/gradle/commits/master/gradle/wrapper/gradle-wrapper.jar]
(please note that Gradle tag v9.8.1 doesn't contain commit
{color:#de350b}{_}*dcc5ee0ec88 Update to Gradle 9.8.1*{_}){color}:
{quote}dejan@home:~/gradle$ *date*
Mon 19 Oct 17:06:56 CEST 2026
dejan@home:~/gradle$ *git remote -v*
origin [https://github.com/gradle/gradle.git] (fetch)
origin [https://github.com/gradle/gradle.git] (push)
dejan@home:~/gradle$ *git log -1 --oneline*
39daf39feb6 (HEAD, tag: v9.8.1) Release notes for Gradle 9.8.1 (#39409)
dejan@home:~/gradle$ *git status*
HEAD detached at v9.8.1
nothing to commit, working tree clean
dejan@home:~/gradle$ *git log --no-abbrev --oneline -12 –
gradle/wrapper/gradle-wrapper.jar | git name-rev --tags --annotate-stdin*
{color:#0747a6}*7bb5f96fca01712ee94624fe67ded6a917e18bd8 (tags/v9.8.0-RC2~10^2)
Update Gradle wrapper to version release-candidate*{color}
8ed35c9985f7c44fe301708803038badf5e96434 (tags/v9.8.0-M2~13^2) Gradle 9.8.0 M1
17901347dad93f15ec0978dbef4c872d7d0d60a6 (tags/v9.7.0-RC2~14^2) Update Gradle
wrapper to version 9.7.0-rc-1
ae5c0f4c6e9171a779e434e8ef52a82d28a63537 (tags/v9.5.0-RC2~21^2) Update Gradle
wrapper to version 9.5.0-rc-1
112aba6448e9022e8539db08e80388c4e4895786 (tags/v9.5.0-RC1~35^2~27^2) Update
wrapper to 9.5.0-milestone-7
5c141fb9464c777ebebb3aa64fa8183294045528 (tags/v9.4.0-RC1~27^2) Update Gradle
wrapper to version release-milestone
11535f629124b74edcc669a8e70cdcde1411bda5 (tags/v9.4.0-M5~3^2~81^2) Update
wrapper to 9.4.0-milestone-4
308880bfbe2ce00713f2bbc821a6498062c43918 (tags/v9.4.0-M2~1^2) Upgradlew to
9.4.0-milestone-1
90638756ec0d38897216423df8447469baddd66e (tags/v9.4.0-M1~86^2~2) Update Gradle
to 9.3.0-milestone-1
16145458453db99eb65e9596c9ac238a1a38764a (tags/v9.2.0-RC2~17^2) Update Gradle
wrapper to version 9.2.0-rc-1
5f992e2737e4cfe20e0bc436a9b605cc460efcf0 (tags/v9.0.0-RC1~59^2~17^2~1) Update
Gradle to 9.0.0-milestone-9
d0e7e8baa15621f68070e863574e60b226bbaa2e (tags/v9.0.0-M7~23^2) Update Gradle to
9.0-milestone-6
dejan@home:~/gradle$ *git checkout master*
Previous HEAD position was 39daf39feb6 Release notes for Gradle 9.8.1 (#39409)
Switched to branch 'master'
Your branch is up-to-date with 'origin/master'.
dejan@home:~/gradle$ *git log -1 --oneline*
a279503d16d (HEAD -> master, origin/master, origin/HEAD) Merge release into
master (20261019) (#39491)
dejan@home:~/gradle$ *git log --no-abbrev --oneline -13 –
gradle/wrapper/gradle-wrapper.jar | git name-rev --tags --annotate-stdin*
{color:#ff0000}*dcc5ee0ec88270575344e6afd490f96d96f84ab3 Update to Gradle
9.8.1*{color}
{color:#0747a6}*7bb5f96fca01712ee94624fe67ded6a917e18bd8 (tags/v9.8.0-RC2~10^2)
Update Gradle wrapper to version release-candidate*{color}
8ed35c9985f7c44fe301708803038badf5e96434 (tags/v9.8.0-M2~13^2) Gradle 9.8.0 M1
17901347dad93f15ec0978dbef4c872d7d0d60a6 (tags/v9.7.0-RC2~14^2) Update Gradle
wrapper to version 9.7.0-rc-1
ae5c0f4c6e9171a779e434e8ef52a82d28a63537 (tags/v9.5.0-RC2~21^2) Update Gradle
wrapper to version 9.5.0-rc-1
112aba6448e9022e8539db08e80388c4e4895786 (tags/v9.5.0-RC1~35^2~27^2) Update
wrapper to 9.5.0-milestone-7
5c141fb9464c777ebebb3aa64fa8183294045528 (tags/v9.4.0-RC1~27^2) Update Gradle
wrapper to version release-milestone
11535f629124b74edcc669a8e70cdcde1411bda5 (tags/v9.4.0-M5~3^2~81^2) Update
wrapper to 9.4.0-milestone-4
308880bfbe2ce00713f2bbc821a6498062c43918 (tags/v9.4.0-M2~1^2) Upgradlew to
9.4.0-milestone-1
90638756ec0d38897216423df8447469baddd66e (tags/v9.4.0-M1~86^2~2) Update Gradle
to 9.3.0-milestone-1
16145458453db99eb65e9596c9ac238a1a38764a (tags/v9.2.0-RC2~17^2) Update Gradle
wrapper to version 9.2.0-rc-1
5f992e2737e4cfe20e0bc436a9b605cc460efcf0 (tags/v9.0.0-RC1~59^2~17^2~1) Update
Gradle to 9.0.0-milestone-9
d0e7e8baa15621f68070e863574e60b226bbaa2e (tags/v9.0.0-M7~23^2) Update Gradle to
9.0-milestone-6
dejan@home:~/gradle$ *date*
Mon 19 Oct 17:09:10 CEST 2026
dejan@home:~/gradle$
{quote}
{*}Related Gradle issue{*}:
[https://github.com/gradle/gradle/issues/39471#issuecomment-6189156726]
*How to reproduce wrapper related issue on Kafka side:*
# try to upgrade Gradle version from 9.7.1 to 9.8.1 (follow manual in
kafka/gradle/wrapper/README.md)
# try to execute Gradle command, for example: *./gradlew clean*
** every *odd* (1st, 3rd, 5th, etc) execution fails (x) with "Unable to access
jarfile" (the wrapper jar fails checksum verification and gets deleted)
** every *even* (2nd, 4th, 6th, etc) execution passes (on) (the wrapper jar is
downloaded again from the v9.8.1 tag and executed without verification)
*Upgrade process (taken from terminal):*
{code:java}
dejan@home:~/kafka$ date
Sat 17 Oct 12:31:32 CEST 2026
dejan@home:~/kafka$ git log -2 --oneline
65566690ca1 (HEAD -> Gradle-9.8.1-yet-another-try, upstream/trunk,
upstream/HEAD) MINOR: Don't block on position() when advancing standby restored
offsets (#23841)
59046aecc31 KAFKA-21289 Fix release.py stage-docs for Hugo kafka-site (#23833)
dejan@home:~/kafka$ git status
On branch Gradle-9.8.1-yet-another-try
nothing to commit, working tree clean
dejan@home:~/kafka$ git diff
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index d670f3658dd..e82ce56aafe 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -58,7 +58,7 @@ versions += [
commonsValidator: "1.11.0",
commonsNet: "3.13.0",
classgraph: "4.8.196",
- gradle: "9.7.1",
+ gradle: "9.8.1",
httpclient: "4.5.14",
jackson: "2.22.3",
jacksonAnnotations: "2.22",
diff --git a/wrapper.gradle b/wrapper.gradle
index 2f7a1dc3245..364ed15fb91 100644
--- a/wrapper.gradle
+++ b/wrapper.gradle
@@ -40,7 +40,7 @@ task bootstrapWrapper() {
// of curl (built against OpenSSL library that doesn't support
TLSv1.2) would fail to
// fetch the jar.
// IMPORTANT: This checksum **must** be updated whenever the Gradle
version changes.
- String wrapperChecksum =
"7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
+ String wrapperChecksum =
"3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
def wrapperJarUrl =
"https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";
def bootstrapString = """
dejan@home:~/kafka$ ./gradlew wrapper --gradle-version 9.8.1
--distribution-type bin --gradle-distribution-sha256-sum
dce76f55f8e251a3a1f130eb120f30b3d271de2b76c9b0729d316b5a1b6dc01f
> Configure project :
Starting build with version 4.5.0-SNAPSHOT (commit id 65566690) using Gradle
9.8.1, Java 17 and Scala 2.13.18
Build properties: ignoreFailures=false, maxParallelForks=8, maxScalacThreads=8,
maxTestRetries=0
[Incubating] Problems report is available at:
file:///home/dejan/kafka/build/reports/problems/problems-report.html
Deprecated Gradle features were used in this build, making it incompatible with
Gradle 10.
You can use '--warning-mode all' to show the individual deprecation warnings
and determine if they come from your own scripts or plugins.
For more on this, please refer to
https://docs.gradle.org/9.7.1/userguide/command_line_interface.html#sec:command_line_warnings
in the Gradle documentation.
BUILD SUCCESSFUL in 11s
9 actionable tasks: 9 executed
Consider enabling configuration cache to speed up this build:
https://docs.gradle.org/9.7.1/userguide/configuration_cache_enabling.html
dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
[Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
4 files changed, 6 insertions(+), 6 deletions(-)
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:15 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:28 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ date
Sat 17 Oct 12:34:41 CEST 2026
dejan@home:~/kafka$
{code}
*Every odd execution (1, 3, 5) fails while every even (2,4,6) execution starts
as expected:*
{code:java}
dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
[Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
4 files changed, 6 insertions(+), 6 deletions(-)
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:15 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ date
Sat 17 Oct 12:34:28 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ date
Sat 17 Oct 12:34:41 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ date
Sat 17 Oct 12:39:30 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$ date
Sat 17 Oct 12:39:43 CEST 2026
dejan@home:~/kafka$ ./gradlew clean
Fetching distribution.
Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
^Cdejan@home:~/kafka$ ./gradlew clean
Error: Unable to access jarfile
/home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
dejan@home:~/kafka$
{code}
> Upgrade Gradle to 9.8.2 (security fix) and fetch the wrapper jar from a
> pinned commit
> -------------------------------------------------------------------------------------
>
> Key: KAFKA-21299
> URL: https://issues.apache.org/jira/browse/KAFKA-21299
> Project: Kafka
> Issue Type: Task
> Components: build
> Reporter: Dejan Stojadinović
> Assignee: Dejan Stojadinović
> Priority: Major
> Labels: Gradle, advisory, build, checksum, gradle, security,
> update, upgrade
>
> (!) Note: this is also addressing security advisory: *Failure to disable
> repositories failing to establish an SSL connection can expose builds to
> malicious artifacts*
> {quote}_When resolving dependencies, Gradle searches repositories in
> declaration order. If it encounters connection errors, Gradle will disable
> the repository and fail dependency resolution. This is necessary for both
> reproducibility and security reasons to prevent dependencies from being
> resolved from other repositories without warning._
> {quote}
> *Scope:*
> * Upgrades Gradle from 9.7.1 to 9.8.2 ( ⚠️ addresses
> [https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5])
> * Fetches the Gradle wrapper jar from a pinned Gradle commit: because
> {{v9.8.1}} tag contains a jar that doesn't match the published 9.8.1 checksum
>
> {color:#ff0000}*Pitfall :*{color} Kafka trunk *wrapper.gradle* pins
> *wrapperJarUrl* to a Gradle tag
> ("https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";)
> that _*may*_ contain the wrapper JAR of the previous Gradle version (i.e.
> release tag contains the bootstrap jar Gradle uses to build itself which may
> be from the previous version and then doesn't match the published wrapper
> checksum).
> *Illustration: 16 Gradle 9.x.y versions share only 8 Wrapper JARs:*
> * Gradle checksums: [https://gradle.org/release-checksums] (or
> [https://services.gradle.org/distributions])
> ||Gradle version(s)||Wrapper JAR Checksum||
> |9.8.1|3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98|
> |9.8.0|238e777fcddd7e34f9708186085def2abd6e08e658505b38718d79d74c21abd5|
> |9.7.1,
> 9.7.0|7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d|
> |9.6.1, 9.6.0, 9.5.1,
> 9.5.0|497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7|
> |9.4.1,
> 9.4.0|55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c|
> |9.3.1,
> 9.3.0|b3a875ddc1f044746e1b1a55f645584505f4a10438c1afea9f15e92a7c42ec13|
> |9.2.1,
> 9.2.0|423cb469ccc0ecc31f0e4e1c309976198ccb734cdcbb7029d4bda0f18f57e8d9|
> |9.1.0,
> 9.0.0|76805e32c009c0cf0dd5d206bddc9fb22ea42e84db904b764f3047de095493f3|
> * Gradle wrapper jar git commits:
> [https://github.com/gradle/gradle/commits/master/gradle/wrapper/gradle-wrapper.jar]
> (please note that Gradle tag v9.8.1 doesn't contain commit
> {color:#de350b}{_}*dcc5ee0ec88 Update to Gradle 9.8.1*{_}){color}:
> {quote}dejan@home:~/gradle$ *date*
> Mon 19 Oct 17:06:56 CEST 2026
> dejan@home:~/gradle$ *git remote -v*
> origin [https://github.com/gradle/gradle.git] (fetch)
> origin [https://github.com/gradle/gradle.git] (push)
> dejan@home:~/gradle$ *git log -1 --oneline*
> 39daf39feb6 (HEAD, tag: v9.8.1) Release notes for Gradle 9.8.1 (#39409)
> dejan@home:~/gradle$ *git status*
> HEAD detached at v9.8.1
> nothing to commit, working tree clean
> dejan@home:~/gradle$ *git log --no-abbrev --oneline -12 –
> gradle/wrapper/gradle-wrapper.jar | git name-rev --tags --annotate-stdin*
> {color:#0747a6}*7bb5f96fca01712ee94624fe67ded6a917e18bd8
> (tags/v9.8.0-RC2~10^2) Update Gradle wrapper to version
> release-candidate*{color}
> 8ed35c9985f7c44fe301708803038badf5e96434 (tags/v9.8.0-M2~13^2) Gradle 9.8.0 M1
> 17901347dad93f15ec0978dbef4c872d7d0d60a6 (tags/v9.7.0-RC2~14^2) Update Gradle
> wrapper to version 9.7.0-rc-1
> ae5c0f4c6e9171a779e434e8ef52a82d28a63537 (tags/v9.5.0-RC2~21^2) Update Gradle
> wrapper to version 9.5.0-rc-1
> 112aba6448e9022e8539db08e80388c4e4895786 (tags/v9.5.0-RC1~35^2~27^2) Update
> wrapper to 9.5.0-milestone-7
> 5c141fb9464c777ebebb3aa64fa8183294045528 (tags/v9.4.0-RC1~27^2) Update Gradle
> wrapper to version release-milestone
> 11535f629124b74edcc669a8e70cdcde1411bda5 (tags/v9.4.0-M5~3^2~81^2) Update
> wrapper to 9.4.0-milestone-4
> 308880bfbe2ce00713f2bbc821a6498062c43918 (tags/v9.4.0-M2~1^2) Upgradlew to
> 9.4.0-milestone-1
> 90638756ec0d38897216423df8447469baddd66e (tags/v9.4.0-M1~86^2~2) Update
> Gradle to 9.3.0-milestone-1
> 16145458453db99eb65e9596c9ac238a1a38764a (tags/v9.2.0-RC2~17^2) Update Gradle
> wrapper to version 9.2.0-rc-1
> 5f992e2737e4cfe20e0bc436a9b605cc460efcf0 (tags/v9.0.0-RC1~59^2~17^2~1) Update
> Gradle to 9.0.0-milestone-9
> d0e7e8baa15621f68070e863574e60b226bbaa2e (tags/v9.0.0-M7~23^2) Update Gradle
> to 9.0-milestone-6
> dejan@home:~/gradle$ *git checkout master*
> Previous HEAD position was 39daf39feb6 Release notes for Gradle 9.8.1 (#39409)
> Switched to branch 'master'
> Your branch is up-to-date with 'origin/master'.
> dejan@home:~/gradle$ *git log -1 --oneline*
> a279503d16d (HEAD -> master, origin/master, origin/HEAD) Merge release into
> master (20261019) (#39491)
> dejan@home:~/gradle$ *git log --no-abbrev --oneline -13 –
> gradle/wrapper/gradle-wrapper.jar | git name-rev --tags --annotate-stdin*
> {color:#ff0000}*dcc5ee0ec88270575344e6afd490f96d96f84ab3 Update to Gradle
> 9.8.1*{color}
> {color:#0747a6}*7bb5f96fca01712ee94624fe67ded6a917e18bd8
> (tags/v9.8.0-RC2~10^2) Update Gradle wrapper to version
> release-candidate*{color}
> 8ed35c9985f7c44fe301708803038badf5e96434 (tags/v9.8.0-M2~13^2) Gradle 9.8.0 M1
> 17901347dad93f15ec0978dbef4c872d7d0d60a6 (tags/v9.7.0-RC2~14^2) Update Gradle
> wrapper to version 9.7.0-rc-1
> ae5c0f4c6e9171a779e434e8ef52a82d28a63537 (tags/v9.5.0-RC2~21^2) Update Gradle
> wrapper to version 9.5.0-rc-1
> 112aba6448e9022e8539db08e80388c4e4895786 (tags/v9.5.0-RC1~35^2~27^2) Update
> wrapper to 9.5.0-milestone-7
> 5c141fb9464c777ebebb3aa64fa8183294045528 (tags/v9.4.0-RC1~27^2) Update Gradle
> wrapper to version release-milestone
> 11535f629124b74edcc669a8e70cdcde1411bda5 (tags/v9.4.0-M5~3^2~81^2) Update
> wrapper to 9.4.0-milestone-4
> 308880bfbe2ce00713f2bbc821a6498062c43918 (tags/v9.4.0-M2~1^2) Upgradlew to
> 9.4.0-milestone-1
> 90638756ec0d38897216423df8447469baddd66e (tags/v9.4.0-M1~86^2~2) Update
> Gradle to 9.3.0-milestone-1
> 16145458453db99eb65e9596c9ac238a1a38764a (tags/v9.2.0-RC2~17^2) Update Gradle
> wrapper to version 9.2.0-rc-1
> 5f992e2737e4cfe20e0bc436a9b605cc460efcf0 (tags/v9.0.0-RC1~59^2~17^2~1) Update
> Gradle to 9.0.0-milestone-9
> d0e7e8baa15621f68070e863574e60b226bbaa2e (tags/v9.0.0-M7~23^2) Update Gradle
> to 9.0-milestone-6
> dejan@home:~/gradle$ *date*
> Mon 19 Oct 17:09:10 CEST 2026
> dejan@home:~/gradle$
> {quote}
> {*}Related Gradle issue{*}:
> [https://github.com/gradle/gradle/issues/39471#issuecomment-6189156726]
> *How to reproduce wrapper related issue on Kafka side:*
> # try to upgrade Gradle version from 9.7.1 to 9.8.1 (follow manual in
> kafka/gradle/wrapper/README.md)
> # try to execute Gradle command, for example: *./gradlew clean*
> ** every *odd* (1st, 3rd, 5th, etc) execution fails (x) with "Unable to
> access jarfile" (the wrapper jar fails checksum verification and gets deleted)
> ** every *even* (2nd, 4th, 6th, etc) execution passes (on) (the wrapper jar
> is downloaded again from the v9.8.1 tag and executed without verification)
> *Upgrade process (taken from terminal):*
> {code:java}
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:31:32 CEST 2026
> dejan@home:~/kafka$ git log -2 --oneline
> 65566690ca1 (HEAD -> Gradle-9.8.1-yet-another-try, upstream/trunk,
> upstream/HEAD) MINOR: Don't block on position() when advancing standby
> restored offsets (#23841)
> 59046aecc31 KAFKA-21289 Fix release.py stage-docs for Hugo kafka-site (#23833)
> dejan@home:~/kafka$ git status
> On branch Gradle-9.8.1-yet-another-try
> nothing to commit, working tree clean
> dejan@home:~/kafka$ git diff
> diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
> index d670f3658dd..e82ce56aafe 100644
> --- a/gradle/dependencies.gradle
> +++ b/gradle/dependencies.gradle
> @@ -58,7 +58,7 @@ versions += [
> commonsValidator: "1.11.0",
> commonsNet: "3.13.0",
> classgraph: "4.8.196",
> - gradle: "9.7.1",
> + gradle: "9.8.1",
> httpclient: "4.5.14",
> jackson: "2.22.3",
> jacksonAnnotations: "2.22",
> diff --git a/wrapper.gradle b/wrapper.gradle
> index 2f7a1dc3245..364ed15fb91 100644
> --- a/wrapper.gradle
> +++ b/wrapper.gradle
> @@ -40,7 +40,7 @@ task bootstrapWrapper() {
> // of curl (built against OpenSSL library that doesn't support
> TLSv1.2) would fail to
> // fetch the jar.
> // IMPORTANT: This checksum **must** be updated whenever the Gradle
> version changes.
> - String wrapperChecksum =
> "7a9ce74cff467ca1bf60a4fcd9f05185acceda4d0f382434d393e17864262c5d"
> + String wrapperChecksum =
> "3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98"
> def wrapperJarUrl =
> "https://raw.githubusercontent.com/gradle/gradle/v$versions.gradle/gradle/wrapper/gradle-wrapper.jar";
>
> def bootstrapString = """
> dejan@home:~/kafka$ ./gradlew wrapper --gradle-version 9.8.1
> --distribution-type bin --gradle-distribution-sha256-sum
> dce76f55f8e251a3a1f130eb120f30b3d271de2b76c9b0729d316b5a1b6dc01f
> > Configure project :
> Starting build with version 4.5.0-SNAPSHOT (commit id 65566690) using Gradle
> 9.8.1, Java 17 and Scala 2.13.18
> Build properties: ignoreFailures=false, maxParallelForks=8,
> maxScalacThreads=8, maxTestRetries=0
> [Incubating] Problems report is available at:
> file:///home/dejan/kafka/build/reports/problems/problems-report.html
> Deprecated Gradle features were used in this build, making it incompatible
> with Gradle 10.
> You can use '--warning-mode all' to show the individual deprecation warnings
> and determine if they come from your own scripts or plugins.
> For more on this, please refer to
> https://docs.gradle.org/9.7.1/userguide/command_line_interface.html#sec:command_line_warnings
> in the Gradle documentation.
> BUILD SUCCESSFUL in 11s
> 9 actionable tasks: 9 executed
> Consider enabling configuration cache to speed up this build:
> https://docs.gradle.org/9.7.1/userguide/configuration_cache_enabling.html
> dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
> [Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
> 4 files changed, 6 insertions(+), 6 deletions(-)
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:15 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:28 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:34:41 CEST 2026
> dejan@home:~/kafka$
> {code}
> *Every odd execution (1, 3, 5) fails while every even (2,4,6) execution
> starts as expected:*
> {code:java}
> dejan@home:~/kafka$ git commit -am "Gradle 9.8.1"
> [Gradle-9.8.1-yet-another-try 3549c86383] Gradle 9.8.1
> 4 files changed, 6 insertions(+), 6 deletions(-)
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:15 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:34:28 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:34:41 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ date
> Sat 17 Oct 12:39:30 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$ date
> Sat 17 Oct 12:39:43 CEST 2026
> dejan@home:~/kafka$ ./gradlew clean
> Fetching distribution.
> Downloading https://services.gradle.org/distributions/gradle-9.8.1-bin.zip
> ^Cdejan@home:~/kafka$ ./gradlew clean
> Error: Unable to access jarfile
> /home/dejan/kafka/gradle/wrapper/gradle-wrapper.jar
> dejan@home:~/kafka$
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
