From 3c7bd07eac36623ee133ac9a0788d71e27625905 Mon Sep 17 00:00:00 2001 From: waterWang Date: Mon, 17 Aug 2026 23:00:00 +0000 Subject: [PATCH] fix: pin httpclient5 to 5.4.3 in expansion service (#39789) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit httpclient5 5.4.3→5.5 upgrade (transitive dependency) breaks OAUTHBEARER auth against GCP Managed Service for Apache Kafka. The google-auth-library- oauth2-http relies on httpclient5 for HTTP transport, and the 5.5 upgrade is incompatible with the existing auth library version. Fixes #39789 --- sdks/java/io/expansion-service/build.gradle | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sdks/java/io/expansion-service/build.gradle b/sdks/java/io/expansion-service/build.gradle index a0c2930c1ff9..8d58bdb453e4 100644 --- a/sdks/java/io/expansion-service/build.gradle +++ b/sdks/java/io/expansion-service/build.gradle @@ -35,6 +35,13 @@ applyJavaNature( configurations.runtimeClasspath { // Pin kafka-clients version due to <3.4.0 missing auth callback classes. resolutionStrategy.force 'org.apache.kafka:kafka-clients:3.9.0' + // Pin httpclient5 to 5.4.3 to fix OAUTHBEARER auth regression (#39789) + // httpclient5 5.5 breaks google-auth-library-oauth2-http transport layer + resolutionStrategy.force 'org.apache.httpcomponents.client5:httpclient5:5.4.3' + resolutionStrategy.force 'org.apache.httpcomponents.client5:httpclient5-fluent:5.4.3' + resolutionStrategy.force 'org.apache.httpcomponents.core5:httpcore5:5.2.5' + resolutionStrategy.force 'org.apache.httpcomponents.core5:httpcore5-h2:5.2.5' + // force parquet-avro:1.15.2 to fix CVE-2025-46762 resolutionStrategy.force 'org.apache.parquet:parquet-avro:1.15.2'