[FLINK-XXX]FLIP-607: Migrate Flink off end-of-life OkHttp; keep it off the core classpath

docs/content.zh/docs/deployment/java_compatibility.md

@@ -30,6 +30,16 @@ This page lists which Java versions Flink supports and what limitations apply (i
 
 Support for Java 11 was added in 1.10.0.
 
+### Native Kubernetes minimum version
+
+Flink's native Kubernetes integration talks to the Kubernetes API server through the JDK built-in
+`java.net.http` HTTP client (via the Fabric8 Kubernetes client), including the WebSocket-based watches that back
+leader election and the pod / ConfigMap informers. Because of [JDK-8245245](https://bugs.openjdk.org/browse/JDK-8245245),
+WebSocket requests whose URL query contains percent-encoded characters are mishandled on Java 11 releases older
+than 11.0.19. Running native Kubernetes — in particular Kubernetes high availability — therefore requires
+**Java 11.0.19 or newer** (the fix was backported via [JDK-8299381](https://bugs.openjdk.org/browse/JDK-8299381)).
+Java 17 and later are unaffected.
+
 ### Untested Flink features
 
 The following Flink features have not been tested with Java 11:

docs/content/docs/deployment/java_compatibility.md

@@ -30,6 +30,16 @@ This page lists which Java versions Flink supports and what limitations apply (i
 
 Support for Java 11 was added in 1.10.0.
 
+### Native Kubernetes minimum version
+
+Flink's native Kubernetes integration talks to the Kubernetes API server through the JDK built-in
+`java.net.http` HTTP client (via the Fabric8 Kubernetes client), including the WebSocket-based watches that back
+leader election and the pod / ConfigMap informers. Because of [JDK-8245245](https://bugs.openjdk.org/browse/JDK-8245245),
+WebSocket requests whose URL query contains percent-encoded characters are mishandled on Java 11 releases older
+than 11.0.19. Running native Kubernetes — in particular Kubernetes high availability — therefore requires
+**Java 11.0.19 or newer** (the fix was backported via [JDK-8299381](https://bugs.openjdk.org/browse/JDK-8299381)).
+Java 17 and later are unaffected.
+
 ### Untested Flink features
 
 The following Flink features have not been tested with Java 11:

flink-dist/pom.xml

@@ -593,6 +593,26 @@ under the License.
 							<skip>true</skip>
 						</configuration>
 					</execution>
+					<execution>
+						<!-- Keep OkHttp/okio off the core Flink distribution classpath. Metrics reporters that
+							 bundle OkHttp declare it as an optional (non-transitive) dependency and ship it shaded
+							 inside their plugin jar, so it never reaches this distribution tree. -->
+						<id>forbid-okhttp-on-core-classpath</id>
+						<goals>
+							<goal>enforce</goal>
+						</goals>
+						<configuration>
+							<rules>
+								<bannedDependencies>
+									<excludes>
+										<exclude>com.squareup.okhttp3:*</exclude>
+										<exclude>com.squareup.okio:*</exclude>
+									</excludes>
+									<message>OkHttp/okio must not be on the core classpath or in the Flink distribution. Use the built-in java.net.http (JDK) client, or isolate OkHttp to a plugin classloader / standalone connector uber-JAR.</message>
+								</bannedDependencies>
+							</rules>
+						</configuration>
+					</execution>
 				</executions>
 			</plugin>
 

flink-kubernetes/pom.xml

@@ -31,7 +31,7 @@ under the License.
 	<packaging>jar</packaging>
 
 	<properties>
-		<kubernetes.client.version>7.3.1</kubernetes.client.version>
+		<kubernetes.client.version>7.8.0</kubernetes.client.version>
 		<surefire.module.config><!--
 			CommonTestUtils#setEnv
 			-->--add-opens=java.base/java.util=ALL-UNNAMED
@@ -75,10 +75,11 @@ under the License.
 			</exclusions>
 		</dependency>
 
-		<!-- Since 7.0.0, Fabric8 uses Vert.x as its HTTP client, but we want to use OkHttp to keep the same dependencies as used before this version. -->
+		<!-- Since 7.0.0, Fabric8 uses Vert.x as its default HTTP client. We use the built-in java.net.http (JDK)
+			 client instead, which keeps OkHttp/okio/Kotlin off the classpath and avoids pulling in Vert.x/Netty. -->
 		<dependency>
 			<groupId>io.fabric8</groupId>
-			<artifactId>kubernetes-httpclient-okhttp</artifactId>
+			<artifactId>kubernetes-httpclient-jdk</artifactId>
 			<version>${kubernetes.client.version}</version>
 			<optional>${flink.markBundledAsOptional}</optional>
 		</dependency>
@@ -131,8 +132,6 @@ under the License.
 									<include>com.fasterxml.jackson.core:jackson-databind</include>
 									<include>com.fasterxml.jackson.dataformat:jackson-dataformat-yaml</include>
 									<include>com.fasterxml.jackson.datatype:jackson-datatype-jsr310</include>
-									<include>com.squareup.okhttp3:*</include>
-									<include>com.squareup.okio:okio</include>
 									<include>org.snakeyaml:*</include>
 									<include>org.yaml:*</include>
 
@@ -197,21 +196,6 @@ under the License.
 									<pattern>com.fasterxml.jackson</pattern>
 									<shadedPattern>org.apache.flink.kubernetes.shaded.com.fasterxml.jackson</shadedPattern>
 								</relocation>
-								<relocation>
-									<pattern>okhttp3/internal/publicsuffix</pattern>
-									<shadedPattern>META-INF</shadedPattern>
-									<includes>
-										<include>**/NOTICE</include>
-									</includes>
-								</relocation>
-								<relocation>
-									<pattern>okhttp3</pattern>
-									<shadedPattern>org.apache.flink.kubernetes.shaded.okhttp3</shadedPattern>
-								</relocation>
-								<relocation>
-									<pattern>okio</pattern>
-									<shadedPattern>org.apache.flink.kubernetes.shaded.okio</shadedPattern>
-								</relocation>
 								<relocation>
 									<pattern>org.snakeyaml</pattern>
 									<shadedPattern>org.apache.flink.kubernetes.shaded.org.snakeyaml</shadedPattern>
@@ -225,16 +209,6 @@ under the License.
 								relocated package: keep each dependency's multi-release (META-INF/versions/N) classes aligned
 								with its relocated base classes. No-op for non-multi-release jars.
 								-->
-								<relocation>
-									<pattern>META-INF/versions/(\d+)/okhttp3/</pattern>
-									<shadedPattern>META-INF/versions/$1/org/apache/flink/kubernetes/shaded/okhttp3/</shadedPattern>
-									<rawString>true</rawString>
-								</relocation>
-								<relocation>
-									<pattern>META-INF/versions/(\d+)/okio/</pattern>
-									<shadedPattern>META-INF/versions/$1/org/apache/flink/kubernetes/shaded/okio/</shadedPattern>
-									<rawString>true</rawString>
-								</relocation>
 								<relocation>
 									<pattern>META-INF/versions/(\d+)/io/fabric8/</pattern>
 									<shadedPattern>META-INF/versions/$1/org/apache/flink/kubernetes/shaded/io/fabric8/</shadedPattern>

flink-kubernetes/src/main/resources/META-INF/NOTICE

@@ -11,34 +11,31 @@ This project bundles the following dependencies under the Apache Software Licens
 - com.fasterxml.jackson.core:jackson-databind:2.21.3
 - com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.3
 - com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.3
-- com.squareup.okhttp3:logging-interceptor:3.14.9
-- com.squareup.okhttp3:okhttp:3.14.9
-- com.squareup.okio:okio:1.17.2
-- io.fabric8:kubernetes-client:7.3.1
-- io.fabric8:kubernetes-client-api:7.3.1
-- io.fabric8:kubernetes-httpclient-okhttp:7.3.1
-- io.fabric8:kubernetes-model-admissionregistration:7.3.1
-- io.fabric8:kubernetes-model-apiextensions:7.3.1
-- io.fabric8:kubernetes-model-apps:7.3.1
-- io.fabric8:kubernetes-model-autoscaling:7.3.1
-- io.fabric8:kubernetes-model-batch:7.3.1
-- io.fabric8:kubernetes-model-certificates:7.3.1
-- io.fabric8:kubernetes-model-common:7.3.1
-- io.fabric8:kubernetes-model-coordination:7.3.1
-- io.fabric8:kubernetes-model-core:7.3.1
-- io.fabric8:kubernetes-model-discovery:7.3.1
-- io.fabric8:kubernetes-model-events:7.3.1
-- io.fabric8:kubernetes-model-extensions:7.3.1
-- io.fabric8:kubernetes-model-flowcontrol:7.3.1
-- io.fabric8:kubernetes-model-gatewayapi:7.3.1
-- io.fabric8:kubernetes-model-metrics:7.3.1
-- io.fabric8:kubernetes-model-networking:7.3.1
-- io.fabric8:kubernetes-model-node:7.3.1
-- io.fabric8:kubernetes-model-policy:7.3.1
-- io.fabric8:kubernetes-model-rbac:7.3.1
-- io.fabric8:kubernetes-model-resource:7.3.1
-- io.fabric8:kubernetes-model-scheduling:7.3.1
-- io.fabric8:kubernetes-model-storageclass:7.3.1
-- io.fabric8:zjsonpatch:7.3.1
+- io.fabric8:kubernetes-client:7.8.0
+- io.fabric8:kubernetes-client-api:7.8.0
+- io.fabric8:kubernetes-httpclient-jdk:7.8.0
+- io.fabric8:kubernetes-model-admissionregistration:7.8.0
+- io.fabric8:kubernetes-model-apiextensions:7.8.0
+- io.fabric8:kubernetes-model-apps:7.8.0
+- io.fabric8:kubernetes-model-autoscaling:7.8.0
+- io.fabric8:kubernetes-model-batch:7.8.0
+- io.fabric8:kubernetes-model-certificates:7.8.0
+- io.fabric8:kubernetes-model-common:7.8.0
+- io.fabric8:kubernetes-model-coordination:7.8.0
+- io.fabric8:kubernetes-model-core:7.8.0
+- io.fabric8:kubernetes-model-discovery:7.8.0
+- io.fabric8:kubernetes-model-events:7.8.0
+- io.fabric8:kubernetes-model-extensions:7.8.0
+- io.fabric8:kubernetes-model-flowcontrol:7.8.0
+- io.fabric8:kubernetes-model-gatewayapi:7.8.0
+- io.fabric8:kubernetes-model-metrics:7.8.0
+- io.fabric8:kubernetes-model-networking:7.8.0
+- io.fabric8:kubernetes-model-node:7.8.0
+- io.fabric8:kubernetes-model-policy:7.8.0
+- io.fabric8:kubernetes-model-rbac:7.8.0
+- io.fabric8:kubernetes-model-resource:7.8.0
+- io.fabric8:kubernetes-model-scheduling:7.8.0
+- io.fabric8:kubernetes-model-storageclass:7.8.0
+- io.fabric8:zjsonpatch:7.8.0
 - org.snakeyaml:snakeyaml-engine:2.6
 - org.yaml:snakeyaml:2.3

flink-metrics/flink-metrics-datadog/pom.xml

@@ -90,6 +90,8 @@ under the License.
 								<includes>
 									<include>com.squareup.okhttp3:*</include>
 									<include>com.squareup.okio:*</include>
+									<!-- OkHttp 4.x is written in Kotlin and requires the Kotlin stdlib at runtime -->
+									<include>org.jetbrains.kotlin:*</include>
 								</includes>
 							</artifactSet>
 							<relocations>

flink-metrics/flink-metrics-datadog/src/main/resources/META-INF/NOTICE

@@ -6,5 +6,10 @@ The Apache Software Foundation (http://www.apache.org/).
 
 This project bundles the following dependencies under the Apache Software License 2.0. (http://www.apache.org/licenses/LICENSE-2.0.txt)
 
-- com.squareup.okhttp3:okhttp:3.14.9
-- com.squareup.okio:okio:1.17.2
+- com.squareup.okhttp3:okhttp:4.12.0
+- com.squareup.okio:okio:3.6.0
+- com.squareup.okio:okio-jvm:3.6.0
+- org.jetbrains.kotlin:kotlin-stdlib:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10

flink-metrics/flink-metrics-influxdb/pom.xml

@@ -49,7 +49,7 @@ under the License.
 		<dependency>
 			<groupId>org.influxdb</groupId>
 			<artifactId>influxdb-java</artifactId>
-			<version>2.17</version>
+			<version>2.24</version>
 			<optional>${flink.markBundledAsOptional}</optional>
 		</dependency>
 
@@ -96,6 +96,8 @@ under the License.
 									<include>com.squareup.okhttp3:*</include>
 									<include>com.squareup.okio:*</include>
 									<include>com.squareup.retrofit2:*</include>
+									<!-- OkHttp 4.x is written in Kotlin and requires the Kotlin stdlib at runtime -->
+									<include>org.jetbrains.kotlin:*</include>
 									<!-- org.msgpack:msgpack-core is not required -->
 								</includes>
 							</artifactSet>

flink-metrics/flink-metrics-influxdb/src/main/resources/META-INF/NOTICE

@@ -7,15 +7,20 @@ The Apache Software Foundation (http://www.apache.org/).
 This project bundles the following dependencies under the Apache Software License 2.0. (http://www.apache.org/licenses/LICENSE-2.0.txt)
 
 - com.squareup.moshi:moshi:1.8.0
-- com.squareup.okhttp3:logging-interceptor:3.14.9
-- com.squareup.okhttp3:okhttp:3.14.9
-- com.squareup.okio:okio:1.17.2
-- com.squareup.retrofit2:converter-moshi:2.6.2
-- com.squareup.retrofit2:retrofit:2.6.2
+- com.squareup.okhttp3:logging-interceptor:4.12.0
+- com.squareup.okhttp3:okhttp:4.12.0
+- com.squareup.okio:okio:3.6.0
+- com.squareup.okio:okio-jvm:3.6.0
+- com.squareup.retrofit2:converter-moshi:2.9.0
+- com.squareup.retrofit2:retrofit:2.9.0
+- org.jetbrains.kotlin:kotlin-stdlib:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10
 
 This project bundles the following dependencies under the MIT license. (https://opensource.org/licenses/MIT)
 
-- org.influxdb:influxdb-java:2.17
+- org.influxdb:influxdb-java:2.24
 
 This project bundles a file called "publicsuffixes.gz":
 

flink-metrics/flink-metrics-otel/pom.xml

@@ -170,6 +170,8 @@ under the License.
 									<include>io.opentelemetry:*</include>
 									<include>com.squareup.okhttp3:*</include>
 									<include>com.squareup.okio:*</include>
+									<!-- OkHttp 4.x is written in Kotlin and requires the Kotlin stdlib at runtime -->
+									<include>org.jetbrains.kotlin:*</include>
 								</includes>
 							</artifactSet>
 							<relocations>

flink-metrics/flink-metrics-otel/src/main/resources/META-INF/NOTICE

@@ -22,5 +22,10 @@ This project bundles the following dependencies under the Apache Software Licens
 - io.opentelemetry:opentelemetry-exporter-otlp-common:1.30.1
 - io.opentelemetry:opentelemetry-exporter-common:1.30.1
 - io.opentelemetry:opentelemetry-exporter-sender-okhttp:1.30.1
-- com.squareup.okhttp3:okhttp:3.14.9
-- com.squareup.okio:okio:1.17.2
+- com.squareup.okhttp3:okhttp:4.12.0
+- com.squareup.okio:okio:3.6.0
+- com.squareup.okio:okio-jvm:3.6.0
+- org.jetbrains.kotlin:kotlin-stdlib:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10

flink-models/flink-model-openai/src/main/resources/META-INF/NOTICE

@@ -23,7 +23,7 @@ This project bundles the following dependencies under the Apache Software Licens
 - org.apache.httpcomponents.client5:httpclient5:5.3.1
 - org.apache.httpcomponents.core5:httpcore5:5.2.4
 - org.apache.httpcomponents.core5:httpcore5-h2:5.2.4
-- org.jetbrains:annotations:13.0
+- org.jetbrains:annotations:17.0.0
 - org.jetbrains.kotlin:kotlin-reflect:1.9.10
 - org.jetbrains.kotlin:kotlin-stdlib:1.9.10
 - org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10

flink-models/flink-model-triton/src/main/resources/META-INF/NOTICE

@@ -12,8 +12,8 @@ This project bundles the following dependencies under the Apache Software Licens
 - com.squareup.okhttp3:okhttp:4.12.0
 - com.squareup.okio:okio:3.6.0
 - com.squareup.okio:okio-jvm:3.6.0
-- org.jetbrains:annotations:13.0
-- org.jetbrains.kotlin:kotlin-stdlib:1.8.21
-- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.21
-- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.21
+- org.jetbrains:annotations:17.0.0
+- org.jetbrains.kotlin:kotlin-stdlib:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10
+- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10
 - org.jetbrains.kotlin:kotlin-stdlib-common:1.9.10

pom.xml

@@ -163,7 +163,10 @@ under the License.
 		<py4j.version>0.10.9.7</py4j.version>
 		<beam.version>2.75.0</beam.version>
 		<protoc.version>4.32.1</protoc.version>
-		<okhttp.version>3.14.9</okhttp.version>
+		<okhttp.version>4.12.0</okhttp.version>
+		<!-- OkHttp 4.x pulls the Kotlin stdlib transitively; pin it so okhttp's and okio's differing
+			 kotlin-stdlib versions converge (matches flink-model-openai). -->
+		<kotlin.version>1.9.10</kotlin.version>
 		<testcontainers.version>2.0.5</testcontainers.version>
 		<lz4.version>1.10.3</lz4.version>
 		<commons.io.version>2.15.1</commons.io.version>
@@ -667,6 +670,33 @@ under the License.
 				<artifactId>logging-interceptor</artifactId>
 				<version>${okhttp.version}</version>
 			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib</artifactId>
+				<version>${kotlin.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-common</artifactId>
+				<version>${kotlin.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-jdk7</artifactId>
+				<version>${kotlin.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jetbrains.kotlin</groupId>
+				<artifactId>kotlin-stdlib-jdk8</artifactId>
+				<version>${kotlin.version}</version>
+			</dependency>
+			<dependency>
+				<!-- Converge the Kotlin stdlib's org.jetbrains:annotations (13.0) with the newer version
+					 pulled by other dependencies such as testcontainers. -->
+				<groupId>org.jetbrains</groupId>
+				<artifactId>annotations</artifactId>
+				<version>17.0.0</version>
+			</dependency>
 
 			<dependency>
 				<!-- re-branded javax.activation:javax.activation-api that is provided by flink-dist
@@ -1924,6 +1954,29 @@ under the License.
 							</rules>
 						</configuration>
 					</execution>
+					<execution>
+						<id>forbid-eol-okhttp</id>
+						<goals>
+							<goal>enforce</goal>
+						</goals>
+						<configuration>
+							<rules>
+								<bannedDependencies>
+									<excludes>
+										<exclude>com.squareup.okhttp3:*:(,4.0)</exclude>
+									</excludes>
+									<includes>
+										<!-- Legacy test-only dependency graphs may still pull EOL OkHttp 3.x; those
+											never reach the distribution, so allow them in test scope, as done for
+											snakeyaml above. (Hadoop's much older com.squareup.okhttp 2.x / okio 1.x are a
+											different groupId and out of scope here.) -->
+										<include>com.squareup.okhttp3:*:(,4.0):*:test</include>
+									</includes>
+									<message>End-of-life OkHttp 3.x is not allowed (no security patches). Use the built-in java.net.http (JDK) client on the core classpath, or a maintained OkHttp 4.x+ isolated to a plugin classloader or a standalone connector uber-JAR.</message>
+								</bannedDependencies>
+							</rules>
+						</configuration>
+					</execution>
 					<execution>
 						<id>forbid-log4j-1</id>
 						<goals>