{"record":{"id":"66d804d92e07404d","repo":"elastic/elasticsearch","slug":"third-party-audit-task-is-not-configured-correctly","errorCode":null,"errorMessage":"Third party audit task is not configured correctly","messagePattern":"Third party audit task is not configured correctly","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/precommit/ThirdPartyAuditTask.java","lineNumber":381,"sourceCode":"                )\n                .toList();\n            throw problemReporter.throwing(\n                new IllegalStateException(\n                    \"Audit of third party dependencies failed:\\n  Jar Hell with the JDK:\\n\" + formatClassList(jdkJarHellClasses)\n                ),\n                problems\n            );\n        }\n    }\n\n    private void assertNoPointlessExclusions(String specifics, Set<String> excludes, Set<String> problematic) {\n        String notMissing = excludes.stream()\n            .filter(each -> problematic.contains(each) == false)\n            .map(each -> \"  * \" + each)\n            .collect(Collectors.joining(\"\\n\"));\n        if (notMissing.isEmpty() == false) {\n            getLogger().error(\"Unnecessary exclusions, following classes \" + specifics + \":\\n {}\", notMissing);\n            throw new IllegalStateException(\"Third party audit task is not configured correctly\");\n        }\n    }\n\n    private String formatClassList(Set<String> classList) {\n        return classList.stream().map(name -> \"  * \" + name).sorted().collect(Collectors.joining(\"\\n\"));\n    }\n\n    private String runForbiddenAPIsCli() throws IOException {\n        ByteArrayOutputStream errorOut = new ByteArrayOutputStream();\n        ExecResult result = execOperations.javaexec(spec -> {\n            if (javaHome.isPresent()) {\n                spec.setExecutable(javaHome.get() + \"/bin/java\");\n            }\n            spec.classpath(getForbiddenAPIsClasspath(), getThirdPartyClasspath());\n            // Enable explicitly for each release as appropriate and just the vector module.\n            if (isJavaVersion(VERSION_20)\n                || isJavaVersion(VERSION_21)\n                || isJavaVersion(VERSION_22)","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/precommit/ThirdPartyAuditTask.java#L363-L399","documentation":"Thrown by ThirdPartyAuditTask.assertNoPointlessExclusions after comparing the configured excludes against the set of classes forbiddenapis actually flagged (problematic). Any exclude that is not in the problematic set is 'pointless' — it excludes a class that wasn't going to fail anyway — so the task logs them and throws IllegalStateException to force the config to be trimmed.","triggerScenarios":"The thirdPartyAudit configuration lists class-level exclusions, but one or more excluded classes no longer trigger any forbiddenapis violation (because the signature set changed, the dependency was upgraded, or the violation was fixed upstream). assertNoPointlessExclusions filters excludes not present in problematic and throws when any remain.","commonSituations":"Upgrading a dependency whose previously-forbidden API call was fixed; forbiddenapis signature bundle updated so a previously-flagged class is now clean; leftover exclusion entries from a previously-resolved violation; removing a dependency but leaving its exclusions in place.","solutions":["Read the 'Unnecessary exclusions' log block printed before the throw; it names each pointless exclude.","Remove those entries from the thirdPartyAudit { ... } exclusions in the project's build.gradle.","Re-run :<project>:thirdPartyAudit to confirm no remaining pointless exclusions and that the audit still passes."],"exampleFix":"// before\nthirdPartyAudit {\n  exclude 'com.example.ClassWithOldViolation'\n}\n// after (violation resolved upstream)\nthirdPartyAudit {\n  // exclusion removed\n}","handlingStrategy":"validation","validationCode":"// Before enabling the audit, diff configured excludes against the latest problematic set\nSet<String> excludes = loadConfiguredExcludes();\nSet<String> problematic = lastForbiddenApisViolations(); // from a baseline run\nSet<String> pointless = excludes.stream().filter(e -> !problematic.contains(e)).collect(toSet());\nif (!pointless.isEmpty()) throw new IllegalStateException(\"Pointless excludes: \" + pointless);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat exclusions as code: remove them in the PR that resolves the underlying violation.","Re-run thirdPartyAudit after any dependency or signature-file upgrade.","Periodically audit exclude lists against current violations and prune."],"tags":["build","gradle","precommit","forbiddenapis","stale-config"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}