elastic/elasticsearch · error · IllegalStateException

Third party audit task is not configured correctly

Error message

Third party audit task is not configured correctly

What it means

Thrown by ThirdPartyAuditTask.assertNoPointlessExclusions after comparing the configured excludes against the set of classes forbiddenapis actually flagged (problematic). Any exclude that is not in the problematic set is 'pointless' — it excludes a class that wasn't going to fail anyway — so the task logs them and throws IllegalStateException to force the config to be trimmed.

Source

Thrown at build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/precommit/ThirdPartyAuditTask.java:381

                )
                .toList();
            throw problemReporter.throwing(
                new IllegalStateException(
                    "Audit of third party dependencies failed:\n  Jar Hell with the JDK:\n" + formatClassList(jdkJarHellClasses)
                ),
                problems
            );
        }
    }

    private void assertNoPointlessExclusions(String specifics, Set<String> excludes, Set<String> problematic) {
        String notMissing = excludes.stream()
            .filter(each -> problematic.contains(each) == false)
            .map(each -> "  * " + each)
            .collect(Collectors.joining("\n"));
        if (notMissing.isEmpty() == false) {
            getLogger().error("Unnecessary exclusions, following classes " + specifics + ":\n {}", notMissing);
            throw new IllegalStateException("Third party audit task is not configured correctly");
        }
    }

    private String formatClassList(Set<String> classList) {
        return classList.stream().map(name -> "  * " + name).sorted().collect(Collectors.joining("\n"));
    }

    private String runForbiddenAPIsCli() throws IOException {
        ByteArrayOutputStream errorOut = new ByteArrayOutputStream();
        ExecResult result = execOperations.javaexec(spec -> {
            if (javaHome.isPresent()) {
                spec.setExecutable(javaHome.get() + "/bin/java");
            }
            spec.classpath(getForbiddenAPIsClasspath(), getThirdPartyClasspath());
            // Enable explicitly for each release as appropriate and just the vector module.
            if (isJavaVersion(VERSION_20)
                || isJavaVersion(VERSION_21)
                || isJavaVersion(VERSION_22)

View on GitHub (pinned to db6a809a66)

Solutions

1. Read the 'Unnecessary exclusions' log block printed before the throw; it names each pointless exclude.
2. Remove those entries from the thirdPartyAudit { ... } exclusions in the project's build.gradle.
3. Re-run :<project>:thirdPartyAudit to confirm no remaining pointless exclusions and that the audit still passes.

Example fix

// before
thirdPartyAudit {
  exclude 'com.example.ClassWithOldViolation'
}
// after (violation resolved upstream)
thirdPartyAudit {
  // exclusion removed
}

// Before enabling the audit, diff configured excludes against the latest problematic set
Set<String> excludes = loadConfiguredExcludes();
Set<String> problematic = lastForbiddenApisViolations(); // from a baseline run
Set<String> pointless = excludes.stream().filter(e -> !problematic.contains(e)).collect(toSet());
if (!pointless.isEmpty()) throw new IllegalStateException("Pointless excludes: " + pointless);

When it happens

Trigger: The thirdPartyAudit configuration lists class-level exclusions, but one or more excluded classes no longer trigger any forbiddenapis violation (because the signature set changed, the dependency was upgraded, or the violation was fixed upstream). assertNoPointlessExclusions filters excludes not present in problematic and throws when any remain.

Common situations: Upgrading a dependency whose previously-forbidden API call was fixed; forbiddenapis signature bundle updated so a previously-flagged class is now clean; leftover exclusion entries from a previously-resolved violation; removing a dependency but leaving its exclusions in place.

Related errors

• Unnecessary split package ignores found
• Forbidden APIs cli failed: {forbiddenApisOutput}
• Unsupported classpath element: {}
• Third party audit was killed buy SIGKILL, could be a victim
• Failed to write keywords report

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/66d804d92e07404d. Report an issue: GitHub.