This is an automated email from the ASF dual-hosted git repository.
wu-sheng pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/skywalking.git
The following commit(s) were added to refs/heads/master by this push:
new 6cf80750ed Migrate Consul client to kiwiproject fork to clear okhttp
CVE-2021-0341 (#13920)
6cf80750ed is described below
commit 6cf80750ed9fa23b42fc73524096030f953701c7
Author: 吴晟 Wu Sheng <[email protected]>
AuthorDate: Fri Jun 19 13:40:19 2026 +0800
Migrate Consul client to kiwiproject fork to clear okhttp CVE-2021-0341
(#13920)
* Migrate Consul client to maintained kiwiproject fork (0.9.0) to clear
okhttp CVE
Migrate the Consul cluster and configuration plugins from the abandoned
com.orbitz.consul:consul-client 1.5.3 to the maintained fork
org.kiwiproject:consul-client 0.9.0 to clear CVE-2021-0341 (okhttp 3.14.9).
- Pin to 0.9.0: the newest fork release still built for JDK 11 bytecode
(1.0.0+ is Java 17, which SkyWalking still targets via
maven.compiler.release=11).
- BOM: bump okhttp 3.14.9 -> 4.12.0 (clears the CVE, Java-8/11 safe); pin
jackson-datatype-jdk8/guava to the managed jackson 2.18.6 so the client
cannot drag in an off-version.
- Source change is a package rename (com.orbitz.consul ->
org.kiwiproject.consul);
plugins use only stable Consul APIs.
- ITs stay on consul:0.9. Regenerated LICENSE and added .licenserc.yaml
mappings.
---
.licenserc.yaml | 5 ++++-
dist-material/release-docs/LICENSE | 15 ++++++++-------
docs/en/changes/changes.md | 1 +
docs/en/setup/backend/backend-cluster.md | 2 ++
docs/en/setup/backend/log-agent-native.md | 1 -
oap-server-bom/pom.xml | 19 ++++++++++++++++---
.../cluster-consul-plugin/pom.xml | 2 +-
.../plugin/consul/ClusterModuleConsulProvider.java | 4 ++--
.../cluster/plugin/consul/ConsulCoordinator.java | 22 +++++++++++-----------
.../ClusterModuleConsulProviderFunctionalIT.java | 4 ++--
.../consul/ClusterModuleConsulProviderTest.java | 2 +-
.../plugin/consul/ConsulCoordinatorTest.java | 14 +++++++-------
.../configuration-consul/pom.xml | 2 +-
.../consul/ConsulConfigurationWatcherRegister.java | 8 ++++----
.../consul/ConsulConfigurationIT.java | 4 ++--
.../ConsulConfigurationWatcherRegisterTest.java | 6 +++---
16 files changed, 65 insertions(+), 46 deletions(-)
diff --git a/.licenserc.yaml b/.licenserc.yaml
index b9399b20e6..d446073adc 100644
--- a/.licenserc.yaml
+++ b/.licenserc.yaml
@@ -109,11 +109,14 @@ dependency:
version: 2.20.1
license: Apache-2.0
- name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
- version: 2.20.1
+ version: 2.18.6,2.20.1
license: Apache-2.0
- name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
version: 2.15.2
license: Apache-2.0
+ - name: org.kiwiproject:consul-client
+ version: 0.9.0
+ license: Apache-2.0
- name: com.graphql-java:graphql-java-extended-scalars
version: 18.1
license: MIT
diff --git a/dist-material/release-docs/LICENSE
b/dist-material/release-docs/LICENSE
index 0776a406b0..a59f02c2f1 100644
--- a/dist-material/release-docs/LICENSE
+++ b/dist-material/release-docs/LICENSE
@@ -203,8 +203,8 @@ The text of each license is the standard Apache 2.0 license.
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core/2.18.6
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.16.0
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.15.2
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-guava/2.12.0
Apache-2.0
-
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.12.0
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-guava/2.18.6
Apache-2.0
+
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.18.6
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.datatype/jackson-datatype-jsr310/2.20.1
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml.jackson.module/jackson-module-kotlin/2.13.4
Apache-2.0
https://mvnrepository.com/artifact/com.fasterxml/classmate/1.5.1 Apache-2.0
@@ -225,9 +225,9 @@ The text of each license is the standard Apache 2.0 license.
https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-grpc/1.34.2
Apache-2.0
https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-grpc-protocol/1.34.2
Apache-2.0
https://mvnrepository.com/artifact/com.linecorp.armeria/armeria-protobuf/1.34.2
Apache-2.0
- https://mvnrepository.com/artifact/com.orbitz.consul/consul-client/1.5.3
Apache-2.0
- https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp/3.14.9
Apache-2.0
- https://mvnrepository.com/artifact/com.squareup.okio/okio/1.17.2 Apache-2.0
+ https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp/4.12.0
Apache-2.0
+ https://mvnrepository.com/artifact/com.squareup.okio/okio/3.6.0 Apache-2.0
+ https://mvnrepository.com/artifact/com.squareup.okio/okio-jvm/3.6.0
Apache-2.0
https://mvnrepository.com/artifact/com.squareup.retrofit2/converter-jackson/2.9.0
Apache-2.0
https://mvnrepository.com/artifact/com.squareup.retrofit2/retrofit/2.9.0
Apache-2.0
https://mvnrepository.com/artifact/com.zaxxer/HikariCP/3.1.0 Apache-2.0
@@ -342,14 +342,15 @@ The text of each license is the standard Apache 2.0
license.
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-reflect/1.7.10
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-stdlib/1.7.10
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-stdlib-common/1.7.10
Apache-2.0
-
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-stdlib-jdk7/1.6.21
Apache-2.0
-
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-stdlib-jdk8/1.6.21
Apache-2.0
+
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-stdlib-jdk7/1.8.21
Apache-2.0
+
https://mvnrepository.com/artifact/org.jetbrains.kotlin/kotlin-stdlib-jdk8/1.8.21
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains.kotlinx/kotlinx-coroutines-core/1.6.4
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains.kotlinx/kotlinx-coroutines-core-jvm/1.6.4
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains.kotlinx/kotlinx-coroutines-jdk8/1.6.4
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains.kotlinx/kotlinx-coroutines-reactive/1.6.4
Apache-2.0
https://mvnrepository.com/artifact/org.jetbrains/annotations/13.0
Apache-2.0
https://mvnrepository.com/artifact/org.jspecify/jspecify/1.0.0 Apache-2.0
+ https://mvnrepository.com/artifact/org.kiwiproject/consul-client/0.9.0
Apache-2.0
https://mvnrepository.com/artifact/org.slf4j/jcl-over-slf4j/1.7.30
Apache-2.0
https://mvnrepository.com/artifact/org.slf4j/log4j-over-slf4j/1.7.30
Apache-2.0
https://mvnrepository.com/artifact/org.snakeyaml/snakeyaml-engine/2.6
Apache-2.0
diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md
index 17c291333f..7658d17f1d 100644
--- a/docs/en/changes/changes.md
+++ b/docs/en/changes/changes.md
@@ -302,6 +302,7 @@
* Mask keywords `trustStorePass`, `keyStorePass` by default.
* Bump up dependencies to clear CVE alerts on shipped OAP jars: log4j `2.25.3`
→ `2.25.4`, jackson `2.18.5` → `2.18.6`, kafka-clients `3.4.0` → `3.9.2`,
postgresql `42.4.4` → `42.7.11`, commons-compress `1.21` → `1.26.2`.
* Bump Apache Curator `4.3.0` → `5.9.0` and Apache ZooKeeper `3.5.7` → `3.9.5`
together to clear CVE-2023-44981 (the bundled ZooKeeper jar carried it; OAP is
a ZooKeeper client only, so the server-side bug was never reachable, but the
jar tripped Dependabot). The cluster-zookeeper and configuration-zookeeper
plugins use only stable Curator APIs, so no source changes were required.
Operator-facing change: the supported ZooKeeper server version is now 3.6+
(Curator 5.x uses ZooKeeper persi [...]
+* Migrate the Consul cluster and configuration client from the abandoned
`com.orbitz.consul:consul-client` `1.5.3` to the maintained fork
`org.kiwiproject:consul-client` `0.9.0` to clear the okhttp CVE the old client
carried (CVE-2021-0341; the old client pinned okhttp `3.14.9`, fixed in okhttp
`4.9.2+`), so the BOM now pins okhttp to `4.12.0`. The fork's `0.9.x` line is
the last one built for JDK 11 (which SkyWalking still targets); `1.0.0+` is
compiled to JDK 17 bytecode, so the migrat [...]
* Bump test-scope assertj-core `3.20.2` → `3.27.7` to clear CVE-2026-24400
(XXE in `isXmlEqualTo`, not used by any test).
* Fix: continuous profiling policy validation now rejects a threshold / count
of `0` to match the error messages and rover's `value >= threshold` trigger
semantics (a `0` threshold would always trigger). CPU percent and HTTP error
rate are tightened from `[0-100]` to `(0-100]`.
* Fix wrong BanyanDB resource options in record data.
diff --git a/docs/en/setup/backend/backend-cluster.md
b/docs/en/setup/backend/backend-cluster.md
index b5a352802f..8bd582a532 100644
--- a/docs/en/setup/backend/backend-cluster.md
+++ b/docs/en/setup/backend/backend-cluster.md
@@ -136,6 +136,8 @@ cluster:
Recently, the Consul system has become more and more popular, and many
companies and developers now use Consul as
their service discovery solution. Set the **cluster/selector** to **consul**
in the yml to enable it.
+The bundled Consul client library is the maintained fork
`org.kiwiproject:consul-client` `0.9.x`, replacing the unmaintained
`com.orbitz.consul:consul-client`.
+
```yaml
cluster:
selector: ${SW_CLUSTER:consul}
diff --git a/docs/en/setup/backend/log-agent-native.md
b/docs/en/setup/backend/log-agent-native.md
index a3c4120759..4a591784bf 100644
--- a/docs/en/setup/backend/log-agent-native.md
+++ b/docs/en/setup/backend/log-agent-native.md
@@ -26,7 +26,6 @@ to report logs through files with automatically injected
trace context.
Log framework config examples:
-- [log4j1.x
fileAppender](../../../../test/e2e-v2/java-test-service/e2e-service-provider/src/main/resources/log4j.properties)
- [log4j2.x
fileAppender](../../../../test/e2e-v2/java-test-service/e2e-service-provider/src/main/resources/log4j2.xml)
- [logback
fileAppender](../../../../test/e2e-v2/java-test-service/e2e-service-provider/src/main/resources/logback.xml)
diff --git a/oap-server-bom/pom.xml b/oap-server-bom/pom.xml
index 81768d79db..e04d58ccfd 100644
--- a/oap-server-bom/pom.xml
+++ b/oap-server-bom/pom.xml
@@ -34,7 +34,7 @@
<graphql-java-tools.version>13.0.1</graphql-java-tools.version>
<graphql-java.version>21.5</graphql-java.version>
<graphql-java-extended-scalars.version>18.1</graphql-java-extended-scalars.version>
- <okhttp.version>3.14.9</okhttp.version>
+ <okhttp.version>4.12.0</okhttp.version>
<httpclient.version>4.5.13</httpclient.version>
<joda-time.version>2.10.5</joda-time.version>
<zookeeper.version>3.9.5</zookeeper.version>
@@ -75,7 +75,7 @@
<banyandb-java-client.version>0.9.2</banyandb-java-client.version>
<kafka-clients.version>3.9.2</kafka-clients.version>
<spring-kafka-test.version>2.4.6.RELEASE</spring-kafka-test.version>
- <consul.client.version>1.5.3</consul.client.version>
+ <consul.client.version>0.9.0</consul.client.version>
<commons-net.version>3.9.0</commons-net.version>
<maven-core.version>3.9.0</maven-core.version>
<async-profiler-converter.version>3.0</async-profiler-converter.version>
@@ -350,6 +350,19 @@
<artifactId>jackson-databind</artifactId>
<version>${jackson-databind.version}</version>
</dependency>
+ <!-- Pin the jackson datatype modules pulled transitively by the
Consul client
+ to the managed jackson version, so the Consul client cannot
drag in an
+ off-version (e.g. 2.15.2) that would skew the jackson family
on the classpath. -->
+ <dependency>
+ <groupId>com.fasterxml.jackson.datatype</groupId>
+ <artifactId>jackson-datatype-jdk8</artifactId>
+ <version>${jackson.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.datatype</groupId>
+ <artifactId>jackson-datatype-guava</artifactId>
+ <version>${jackson.version}</version>
+ </dependency>
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
@@ -639,7 +652,7 @@
</dependency>
<dependency>
- <groupId>com.orbitz.consul</groupId>
+ <groupId>org.kiwiproject</groupId>
<artifactId>consul-client</artifactId>
<version>${consul.client.version}</version>
<exclusions>
diff --git a/oap-server/server-cluster-plugin/cluster-consul-plugin/pom.xml
b/oap-server/server-cluster-plugin/cluster-consul-plugin/pom.xml
index 27fcdc9bb3..db4bf39026 100644
--- a/oap-server/server-cluster-plugin/cluster-consul-plugin/pom.xml
+++ b/oap-server/server-cluster-plugin/cluster-consul-plugin/pom.xml
@@ -35,7 +35,7 @@
<version>${project.version}</version>
</dependency>
<dependency>
- <groupId>com.orbitz.consul</groupId>
+ <groupId>org.kiwiproject</groupId>
<artifactId>consul-client</artifactId>
<exclusions>
<exclusion>
diff --git
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProvider.java
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProvider.java
index 50a4e6c730..23c4b195a9 100644
---
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProvider.java
+++
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProvider.java
@@ -19,8 +19,8 @@
package org.apache.skywalking.oap.server.cluster.plugin.consul;
import com.google.common.net.HostAndPort;
-import com.orbitz.consul.Consul;
-import com.orbitz.consul.ConsulException;
+import org.kiwiproject.consul.Consul;
+import org.kiwiproject.consul.ConsulException;
import java.util.ArrayList;
import java.util.List;
import org.apache.commons.lang3.StringUtils;
diff --git
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinator.java
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinator.java
index 8ba79589e3..575af94c0d 100644
---
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinator.java
+++
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/main/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinator.java
@@ -19,16 +19,16 @@
package org.apache.skywalking.oap.server.cluster.plugin.consul;
import com.google.common.base.Strings;
-import com.orbitz.consul.AgentClient;
-import com.orbitz.consul.Consul;
-import com.orbitz.consul.HealthClient;
-import com.orbitz.consul.cache.ConsulCache;
-import com.orbitz.consul.cache.ServiceHealthCache;
-import com.orbitz.consul.cache.ServiceHealthKey;
-import com.orbitz.consul.model.agent.ImmutableRegistration;
-import com.orbitz.consul.model.agent.Registration;
-import com.orbitz.consul.model.health.ServiceHealth;
-import com.orbitz.consul.option.QueryOptions;
+import org.kiwiproject.consul.AgentClient;
+import org.kiwiproject.consul.Consul;
+import org.kiwiproject.consul.HealthClient;
+import org.kiwiproject.consul.cache.ConsulCache;
+import org.kiwiproject.consul.cache.ServiceHealthCache;
+import org.kiwiproject.consul.cache.ServiceHealthKey;
+import org.kiwiproject.consul.model.agent.ImmutableRegistration;
+import org.kiwiproject.consul.model.agent.Registration;
+import org.kiwiproject.consul.model.health.ServiceHealth;
+import org.kiwiproject.consul.option.QueryOptions;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
@@ -175,7 +175,7 @@ public class ConsulCoordinator extends ClusterCoordinator {
/**
* Notice: If the consul version > v1.10.0, the `consul-client
ConsulCache` will throw error response:
- * "com.orbitz.consul.ConsulException: Consul cluster has no elected
leader" and fails to retrieve data.
+ * "org.kiwiproject.consul.ConsulException: Consul cluster has no elected
leader" and fails to retrieve data.
* This is a known issue but doesn't release yet, can refer to:
https://github.com/rickfast/consul-client/pull/456
*/
class ConsulEventListener implements
ConsulCache.Listener<ServiceHealthKey, ServiceHealth> {
diff --git
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderFunctionalIT.java
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderFunctionalIT.java
index 03685436a2..9bdc012a40 100644
---
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderFunctionalIT.java
+++
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderFunctionalIT.java
@@ -19,8 +19,8 @@
package org.apache.skywalking.oap.server.cluster.plugin.consul;
import com.google.common.base.Strings;
-import com.orbitz.consul.AgentClient;
-import com.orbitz.consul.Consul;
+import org.kiwiproject.consul.AgentClient;
+import org.kiwiproject.consul.Consul;
import lombok.Getter;
import org.apache.skywalking.oap.server.core.cluster.ClusterCoordinator;
import org.apache.skywalking.oap.server.core.cluster.ClusterNodesQuery;
diff --git
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderTest.java
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderTest.java
index c6112aef5b..e181837972 100644
---
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderTest.java
+++
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ClusterModuleConsulProviderTest.java
@@ -20,7 +20,7 @@ package
org.apache.skywalking.oap.server.cluster.plugin.consul;
import com.google.common.collect.Lists;
import com.google.common.net.HostAndPort;
-import com.orbitz.consul.Consul;
+import org.kiwiproject.consul.Consul;
import org.apache.skywalking.oap.server.core.CoreModule;
import org.apache.skywalking.oap.server.core.cluster.ClusterModule;
import org.apache.skywalking.oap.server.library.module.ModuleManager;
diff --git
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinatorTest.java
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinatorTest.java
index b2d94e39c0..ca36fd0452 100644
---
a/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinatorTest.java
+++
b/oap-server/server-cluster-plugin/cluster-consul-plugin/src/test/java/org/apache/skywalking/oap/server/cluster/plugin/consul/ConsulCoordinatorTest.java
@@ -18,13 +18,13 @@
package org.apache.skywalking.oap.server.cluster.plugin.consul;
-import com.orbitz.consul.AgentClient;
-import com.orbitz.consul.Consul;
-import com.orbitz.consul.HealthClient;
-import com.orbitz.consul.model.ConsulResponse;
-import com.orbitz.consul.model.agent.Registration;
-import com.orbitz.consul.model.health.Service;
-import com.orbitz.consul.model.health.ServiceHealth;
+import org.kiwiproject.consul.AgentClient;
+import org.kiwiproject.consul.Consul;
+import org.kiwiproject.consul.HealthClient;
+import org.kiwiproject.consul.model.ConsulResponse;
+import org.kiwiproject.consul.model.agent.Registration;
+import org.kiwiproject.consul.model.health.Service;
+import org.kiwiproject.consul.model.health.ServiceHealth;
import org.apache.skywalking.oap.server.core.cluster.RemoteInstance;
import org.apache.skywalking.oap.server.core.remote.client.Address;
import org.apache.skywalking.oap.server.library.module.ModuleDefineHolder;
diff --git a/oap-server/server-configuration/configuration-consul/pom.xml
b/oap-server/server-configuration/configuration-consul/pom.xml
index 9f646c99fa..8e12a6a408 100644
--- a/oap-server/server-configuration/configuration-consul/pom.xml
+++ b/oap-server/server-configuration/configuration-consul/pom.xml
@@ -42,7 +42,7 @@
</dependency>
<dependency>
- <groupId>com.orbitz.consul</groupId>
+ <groupId>org.kiwiproject</groupId>
<artifactId>consul-client</artifactId>
<exclusions>
<exclusion>
diff --git
a/oap-server/server-configuration/configuration-consul/src/main/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegister.java
b/oap-server/server-configuration/configuration-consul/src/main/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegister.java
index 349b06a449..dd1aa62ed8 100644
---
a/oap-server/server-configuration/configuration-consul/src/main/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegister.java
+++
b/oap-server/server-configuration/configuration-consul/src/main/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegister.java
@@ -20,10 +20,10 @@ package
org.apache.skywalking.oap.server.configuration.consul;
import com.google.common.base.Splitter;
import com.google.common.net.HostAndPort;
-import com.orbitz.consul.Consul;
-import com.orbitz.consul.KeyValueClient;
-import com.orbitz.consul.cache.KVCache;
-import com.orbitz.consul.model.kv.Value;
+import org.kiwiproject.consul.Consul;
+import org.kiwiproject.consul.KeyValueClient;
+import org.kiwiproject.consul.cache.KVCache;
+import org.kiwiproject.consul.model.kv.Value;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
diff --git
a/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationIT.java
b/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationIT.java
index d3a2e79906..3085408d59 100644
---
a/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationIT.java
+++
b/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationIT.java
@@ -19,8 +19,8 @@
package org.apache.skywalking.oap.server.configuration.consul;
import com.google.common.net.HostAndPort;
-import com.orbitz.consul.Consul;
-import com.orbitz.consul.KeyValueClient;
+import org.kiwiproject.consul.Consul;
+import org.kiwiproject.consul.KeyValueClient;
import
org.apache.skywalking.oap.server.library.module.ApplicationConfiguration;
import org.apache.skywalking.oap.server.library.module.ModuleManager;
import org.apache.skywalking.oap.server.library.util.CollectionUtils;
diff --git
a/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegisterTest.java
b/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegisterTest.java
index 7d1dc5a80f..cbfbb477b4 100644
---
a/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegisterTest.java
+++
b/oap-server/server-configuration/configuration-consul/src/test/java/org/apache/skywalking/oap/server/configuration/consul/ConsulConfigurationWatcherRegisterTest.java
@@ -21,9 +21,9 @@ package org.apache.skywalking.oap.server.configuration.consul;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.Sets;
import com.google.common.io.BaseEncoding;
-import com.orbitz.consul.cache.ConsulCache;
-import com.orbitz.consul.cache.KVCache;
-import com.orbitz.consul.model.kv.ImmutableValue;
+import org.kiwiproject.consul.cache.ConsulCache;
+import org.kiwiproject.consul.cache.KVCache;
+import org.kiwiproject.consul.model.kv.ImmutableValue;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.mockito.ArgumentCaptor;
