Repository navigation
[Task]: Also remove META-INF for excluded transitive dependencies in Beam vendored dependencies #28919
Description
What needs to happen?
We vendor a few dependencies (nowadays only guava, grpc, calcite), where some transitive dependency were explicitly excluded, e.g.
beam/vendor/calcite-1_28_0/build.gradle
Lines 94 to 95 in b876299
But their META-INF still exists in the vendored jar artifact. This gives false positive vulnerability alerts for some user.
This tasks involves
- Investigate whether removing these META-INF would break Beam
- If not, improve the vendor build script to also exclude META-INF for these excluded transitive dependencies
Issue Priority
Priority: 2
Issue Components
- Component: Python SDK
- Component: Java SDK
- Component: Go SDK
- Component: Typescript SDK
- Component: IO connector
- Component: Beam YAML
- Component: Beam examples
- Component: Beam playground
- Component: Beam katas
- Component: Website
- Component: Spark Runner
- Component: Flink Runner
- Component: Samza Runner
- Component: Twister2 Runner
- Component: Hazelcast Jet Runner
- Component: Google Cloud Dataflow Runner
Activity
github-actions commentedon Jun 13, 2026
This issue has been marked as stale due to 150 days of inactivity. It will be closed in 30 days if no further activity occurs. If you think that’s incorrect or this issue still needs to be addressed, please simply write any comment. If closed, you can reopen the issue at any time. Thank you for your contributions.
goutamadwant commentedon Aug 16, 2026
Hi @Abacn, I checked the current vendoring setup and #28919 still appears relevant for the Calcite/gRPC/Guava artifacts. Is this task still required? If so, would you prefer a generic VendorJavaPlugin solution with JAR-content regression tests, or per-vendor metadata exclusions? I can work on thos. thanks!