Skip to content

fix: pin httpclient5 to 5.4.3 in expansion service to fix OAUTHBEARER auth regression - #39790

Closed
waterWang wants to merge 1 commit into
apache:masterfrom
waterWang:fix/beam-39789-pin-httpclient5
Closed

waterWang wants to merge 1 commit into
apache:masterfrom
waterWang:fix/beam-39789-pin-httpclient5

Conversation

@waterWang

Copy link
Copy Markdown

Fixes #39789

The httpclient5 5.4.3→5.5 upgrade broke OAUTHBEARER auth against GCP Managed Service for Apache Kafka. The google-auth-library-oauth2-http (1.37.1) is compiled against httpclient5 5.4.x and the 5.5 upgrade introduces binary incompatibility at runtime.

This pins httpclient5 (and its transitive httpcore5) to the versions that were in use at Beam 2.68.0, which was the last known-good release.

See #39789 for full bisection details.

@github-actions

Copy link
Copy Markdown
Contributor

Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment assign set of reviewers

@Abacn

Abacn commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Please refrain from using automated Agent sending untested PRs. This would squeeze reviewer resources

httpclient5 5.4.3→5.5 upgrade (transitive dependency) breaks OAUTHBEARER
auth against GCP Managed Service for Apache Kafka. The google-auth-library-
oauth2-http relies on httpclient5 for HTTP transport, and the 5.5 upgrade
is incompatible with the existing auth library version.

Fixes apache#39789
@kennknowles

Copy link
Copy Markdown
Member

I'm unclear whether this is a good fix, and if it is an OK fix if it should be in BeamModulePlugin rather than the expansion service build file. In any event, this PR needs an integration test that fails before the change and passes after.

@stankiewicz

Copy link
Copy Markdown
Contributor

#40311 is proper fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]:KafkaIO OAUTHBEARER auth against GCP Managed Service for Apache Kafka broken starting 2.69.0 (works on 2.68.0)

4 participants