Close Open Privacy Scan
App Privacy Score
67
/100
Medium privacy risk — possible application leak
Medium risk · 420 finding(s)
Based on: 176 first-party package(s) · 30/220 deps analyzed
Dependency score: 92 (Low risk)
bar_chart Score Breakdown
pii_flow
−30
env_fs
−3
list Scan Summary
0 high
2 medium
418 low
First-party packages:
49
Dependency packages:
3
Ecosystem:
java
swap_horiz Potential data exfiltration in application code
External domains:
apache.orgapi-cd.vespa.ouryahoo.comapi-ctl.cd.vespa-cloud.comapi-ctl.vespa-cloud.comapi.github.comapi.openai.comapi.vespa.ouryahoo.comapi.voyageai.comconsole-cd.vespa.ouryahoo.comconsole.publiccd.cd-vespa-cloud.comconsole.vespa-cloud.comconsole.vespa.ouryahoo.comdata.vespa-cloud.comdefault-1.htmldefault-2.htmldefault-3.htmldefault-4.htmldocs.vespa.aidummy.examplegithub.comgo.devgolang.orgjsoup.orgopentelemetry.iopkg.go.devpublicsuffix.orgpurl.oclc.orgraw.githubusercontent.comreact.devreactjs.orgrelaxng.orgunicode.orgvespa.aiwww.ascc.netwww.iana.orgwww.ibm.comwww.oracle.comwww.thaiopensource.comwww.w3.orgxml.orgzookeeper.sasl.client.canonicalize.hostnamezts.athenz.ouroath.com
medium
first-party (java): vespaclient-java
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
- 1source
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:840 - 2sink
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:844
medium
first-party (java): vespaclient-java
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
- 1source
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:840 - 2sink
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:900
</> First-Party Code
first-party (java): vespaclient-java
java first-party
medium
pii_flow
production
#33b84e0ad8edd437
—
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:844
· flow /tmp/closeopen-gnjrqhax/repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:840 → /tmp/closeopen-gnjrqhax/repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:844
System.err.print(Text.format("Resuming visitor already %.1f %% finished.\n",
visitorParameters.getResumeToken().percentFinished()));PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium
pii_flow
production
#8b6c30a29303e2af
—
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:900
· flow /tmp/closeopen-gnjrqhax/repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:840 → /tmp/closeopen-gnjrqhax/repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:900
System.out.println(session.getTrace().toString());PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 14 low-confidence finding(s)
low env_fs — Filesystem access. 13 locations
low
env_fs
production
#399d096ecb6b194d
capability detected · no path traced
—
Environment-variable access.
repo/vespaclient-java/src/main/java/com/yahoo/vespa/security/tool/Main.java:52
int returnCode = program.execute(args, System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): abi-check-plugin
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low env_fs — Environment-variable access. 2 locations
first-party (java): application
java first-partyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
first-party (java): bundle-plugin
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#004f9cc0c8f55c2d
capability detected · no path traced
—
Filesystem access.
repo/bundle-plugin/src/main/java/com/yahoo/container/plugin/classanalysis/Analyze.java:37
return analyzeClass(new FileInputStream(classFile), jdkVersionCheck, artifactVersion);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): cloud/cloud-tenant-cd
java first-partyexpand_more 2 low-confidence finding(s)
low
env_fs
production
#63e7a61976bb50f5
capability detected · no path traced
—
Environment-variable access.
repo/cloud/cloud-tenant-cd/src/main/java/ai/vespa/hosted/cd/cloud/impl/VespaTestRuntime.java:71
String configPath = System.getProperty("vespa.test.config");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low
env_fs
production
#bc863dd005d8bc93
capability detected · no path traced
—
Filesystem access.
repo/cloud/cloud-tenant-cd/src/main/java/ai/vespa/hosted/cd/cloud/impl/VespaTestRuntime.java:84
return TestConfig.fromJson(Files.readAllBytes(Paths.get(path)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): cloud/hosted-api
java first-partyexpand_more 6 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
low env_fs — Environment-variable access. 2 locations
first-party (java): cloud/tenant-cd-commons
java first-partyexpand_more 2 low-confidence finding(s)
first-party (java): cloud/vespa-maven-plugin
java first-partyexpand_more 6 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low env_fs — Filesystem access. 4 locations
first-party (java): config
java first-partyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
first-party (java): config-application-package
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
low
env_fs
production
#186ae4e96ff6dbca
capability detected · no path traced
—
Environment-variable access.
repo/config-application-package/src/main/java/com/yahoo/config/model/application/provider/SchemaValidators.java:34
private static final String schemaDirBase = System.getProperty("java.io.tmpdir", File.separator + "tmp" + File.separator + "vespa");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): config-model
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
first-party (java): config-proxy
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
first-party (java): configgen
java first-partyexpand_more 8 low-confidence finding(s)
low
env_fs
production
#585389af3c126feb
capability detected · no path traced
—
Filesystem access.
repo/configgen/src/main/java/com/yahoo/config/codegen/MakeConfig.java:35
DefParser parser = new DefParser(name, new FileReader(specFile, StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 7 locations
first-party (java): configserver
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low
env_fs
production
#79e902ae8b1359bd
capability detected · no path traced
—
Filesystem access.
repo/configserver/src/main/java/com/yahoo/vespa/config/server/filedistribution/FileDirectory.java:224
try (FileChannel sourceChannel = new FileInputStream(source).getChannel();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-disc
java first-partyexpand_more 16 low-confidence finding(s)
low env_fs — Environment-variable access. 9 locations
low env_fs — Filesystem access. 7 locations
first-party (java): container-llama
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#accc88b240cb8036
capability detected · no path traced
—
Environment-variable access.
repo/container-llama/src/main/java/ai/vespa/llama/LlamaBundleActivator.java:25
if (SKIP_VALUE.equals(System.getProperty(skipAll))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-messagebus
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#b75e3e349d59f547
capability detected · no path traced
—
Environment-variable access.
repo/container-messagebus/src/main/java/com/yahoo/container/jdisc/messagebus/NetworkMultiplexerProvider.java:29
this(net, mbusConfig, System.getProperty("config.id")); //:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-onnxruntime
java first-partyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
first-party (java): container-opentelemetry
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#e2bef6ffd90345b1
capability detected · no path traced
—
Filesystem access.
repo/container-opentelemetry/src/main/java/ai/vespa/telemetry/otel/OtelTelemetry.java:117
String hostname = Files.readString(hostnameFile).trim();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-search
java first-partyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low
env_fs
production
#b19c490ee2120062
capability detected · no path traced
—
Environment-variable access.
repo/container-search/src/main/java/com/yahoo/search/logging/LocalDiskLogger.java:22
fw.write(System.getProperty("line.separator"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): defaults
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
first-party (java): document
java first-partyexpand_more 2 low-confidence finding(s)
low
env_fs
production
#94e2830cd9a581f4
capability detected · no path traced
—
Environment-variable access.
repo/document/src/main/java/com/yahoo/document/datatypes/StringFieldValue.java:43
private static final boolean replaceInvalidUnicode = System.getProperty("vespa.replace_invalid_unicode", "false").equals("true");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low
env_fs
production
#4f5975c6dbcf59b0
capability detected · no path traced
—
Filesystem access.
repo/document/src/main/java/com/yahoo/vespaxmlparser/VespaXMLReader.java:21
this(new FileInputStream(fileName), docTypeManager);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): documentapi
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#2a5915454539cc47
capability detected · no path traced
—
Environment-variable access.
repo/documentapi/src/main/java/com/yahoo/documentapi/messagebus/MessageBusDocumentAccess.java:62
if (System.getProperty("vespa.local", "false").equals("true")) { // set by Application when running locallyReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): filedistribution
java first-partyexpand_more 11 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
low env_fs — Filesystem access. 7 locations
first-party (java): flags
java first-partyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
first-party (java): fsa
java first-partyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
first-party (java): indexinglanguage
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#d7fc3668d3e3cb11
capability detected · no path traced
—
Environment-variable access.
repo/indexinglanguage/src/main/java/com/yahoo/vespa/indexinglanguage/linguistics/LinguisticsAnnotator.java:45
Boolean.parseBoolean(System.getenv("VESPA_DISABLE_LINGUISTICS_BINARY_CHECK"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): integration/logstash-plugins/logstash-output-vespa
java first-partyexpand_more 8 low-confidence finding(s)
low env_fs — Filesystem access. 6 locations
first-party (java): integration/schema-language-server/language-server
java first-partyexpand_more 4 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
low
env_fs
production
#8b7af82f77c555fe
capability detected · no path traced
—
Environment-variable access.
repo/integration/schema-language-server/language-server/src/main/java/ai/vespa/schemals/lsp/common/command/commandtypes/RunVespaQuery.java:107
boolean isWindows = System.getProperty("os.name").toLowerCase(Locale.ROOT).startsWith("windows");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): integration/schema-language-server/lemminx-vespa
java first-partyexpand_more 2 low-confidence finding(s)
first-party (java): jdisc_core
java first-partyexpand_more 15 low-confidence finding(s)
low env_fs — Environment-variable access. 13 locations
low env_fs — Filesystem access. 2 locations
first-party (java): linguistics
java first-partyexpand_more 2 low-confidence finding(s)
first-party (java): linguistics-components
java first-partyexpand_more 2 low-confidence finding(s)
first-party (java): logserver
java first-partyexpand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 2 locations
first-party (java): metrics-proxy
java first-partyexpand_more 2 low-confidence finding(s)
low
env_fs
production
#c81cf49fba3a3d90
capability detected · no path traced
—
Filesystem access.
repo/metrics-proxy/src/main/java/ai/vespa/metricsproxy/service/SystemPoller.java:118
s = Files.readString(Path.of("/proc/" + pid + "/statm"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low
env_fs
production
#85768199675aed08
capability detected · no path traced
—
Environment-variable access.
repo/metrics-proxy/src/main/java/ai/vespa/metricsproxy/service/SystemPollerProvider.java:46
return System.getProperty("os.name");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): model-evaluation
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#850e1f609890ac36
capability detected · no path traced
—
Filesystem access.
repo/model-evaluation/src/main/java/ai/vespa/models/evaluation/RankProfilesConfigImporter.java:252
? Utf8.toString(IOUtils.readBytes(new LZ4FrameInputStream(new FileInputStream(file)), 65536))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): model-integration
java first-partyexpand_more 8 low-confidence finding(s)
low env_fs — Filesystem access. 8 locations
first-party (java): predicate-search
java first-partyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
first-party (java): searchlib
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#f009c3b86f9b2190
capability detected · no path traced
—
Filesystem access.
repo/searchlib/src/main/java/com/yahoo/searchlib/gbdt/XmlHelper.java:39
return parseXmlStream(new FileInputStream(fileName));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): security-utils
java first-partyexpand_more 16 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low env_fs — Environment-variable access. 6 locations
first-party (java): standalone-container
java first-partyexpand_more 20 low-confidence finding(s)
low
env_fs
production
#e4048438e7824423
capability detected · no path traced
—
Filesystem access.
repo/standalone-container/src/main/java/com/yahoo/application/container/impl/StandaloneContainerRunner.java:32
Files.write(servicesXmlFile, Utf8.toBytes(content));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 19 locations
first-party (java): vespa-application-maven-plugin
java first-partyexpand_more 2 low-confidence finding(s)
first-party (java): vespa-enforcer-extensions
java first-partyexpand_more 2 low-confidence finding(s)
low
env_fs
production
#2b2c5232727d022c
capability detected · no path traced
—
Environment-variable access.
repo/vespa-enforcer-extensions/src/main/java/com/yahoo/vespa/maven/plugin/enforcer/AllowedDependencies.java:81
var guessProperty = Optional.ofNullable(System.getProperty(GUESS_VERSION))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low
env_fs
production
#9c4f88c2938851c7
capability detected · no path traced
—
Filesystem access.
repo/vespa-enforcer-extensions/src/main/java/com/yahoo/vespa/maven/plugin/enforcer/AllowedDependencies.java:189
try (Stream<String> s = Files.lines(specFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespa-feed-client-api
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#9ca3205350bd406e
capability detected · no path traced
—
Environment-variable access.
repo/vespa-feed-client-api/src/main/java/ai/vespa/feed/client/Helper.java:36
String preferredImplementation = System.getProperty(PREFERRED_IMPLEMENTATION_PROPERTY, defaultImplementation);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespa-feed-client-cli
java first-partyexpand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low
env_fs
production
#22e9512023dedb67
capability detected · no path traced
—
Environment-variable access.
repo/vespa-feed-client-cli/src/main/java/ai/vespa/feed/client/impl/CliClient.java:244
if (System.getenv("VESPA_EXTENDED_STATS") != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespaclient-container-plugin
java first-partyexpand_more 1 low-confidence finding(s)
low
env_fs
production
#24012ebd4111fac5
capability detected · no path traced
—
Environment-variable access.
repo/vespaclient-container-plugin/src/main/java/com/yahoo/document/restapi/resource/InstrumentedThrottlePolicy.java:31
var windowSize = System.getenv(WINDOW_SIZE_ENV);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespajlib
java first-partyexpand_more 15 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
low env_fs — Filesystem access. 12 locations
first-party (java): vespalog
java first-partyexpand_more 12 low-confidence finding(s)
low env_fs — Environment-variable access. 12 locations
first-party (java): zookeeper-server/zookeeper-server-common
java first-partyexpand_more 2 low-confidence finding(s)
</> Dependencies
com.thaiopensource:jing
java dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
org.apache.zookeeper:zookeeper
java dependencyexpand_more 167 low-confidence finding(s)
low env_fs — Environment-variable access. 139 locations
low env_fs — Filesystem access. 28 locations
org.jsoup:jsoup
java dependencyexpand_more 4 low-confidence finding(s)
low
egress
dependency
Excluded from app score
#45604a1b41c5c129
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/java/[email protected]/org/jsoup/helper/HttpConnection.java:415
UnsetUrl = new URL("http://undefined/");Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs — Environment-variable access. 3 locations
Skipped dependencies
Production
- github.com/klauspost/compress prod — module zip exceeds byte cap
- org.apache.maven.plugin-tools:maven-plugin-annotations prod — no version pinned
- org.ow2.asm:asm prod — no version pinned
- com.fasterxml.jackson.core:jackson-databind prod — no version pinned
- org.junit.jupiter:junit-jupiter-api prod — no sources jar (404)
- org.hamcrest:hamcrest prod — no version pinned
- junit:junit prod — no version pinned
- com.yahoo.vespa:standalone-container prod — no sources jar (404)
- com.yahoo.vespa:config-provisioning prod — no sources jar (404)
- com.yahoo.vespa:config-model prod — no sources jar (404)
- com.yahoo.vespa:config-model-api prod — no sources jar (404)
- com.yahoo.vespa:http-utils prod — no sources jar (404)
- com.yahoo.vespa:model-integration prod — no sources jar (404)
- com.yahoo.vespa:container-dev prod — no sources jar (404)
- com.yahoo.vespa:jrt prod — no sources jar (404)
- com.yahoo.vespa:container-apache-http-client-bundle prod — no sources jar (404)
- com.ibm.icu:icu4j prod — no version pinned
- org.antlr:antlr-runtime prod — no version pinned
- org.antlr:antlr4-runtime prod — no version pinned
- org.apache.felix:org.apache.felix.framework prod — no version pinned
- org.apache.felix:org.apache.felix.log prod — no version pinned
- org.apache.opennlp:opennlp-tools prod — no version pinned
- com.huaban:jieba-analysis prod — no version pinned
- org.apache.commons:commons-lang3 prod — no version pinned
- org.hdrhistogram:HdrHistogram prod — no version pinned
- xerces:xercesImpl prod — no version pinned
- org.apache.commons:commons-math3 prod — no version pinned
- jakarta.inject:jakarta.inject-api prod — no version pinned
- io.micrometer:micrometer-core prod — no version pinned
- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor prod — no version pinned
- io.opentelemetry:opentelemetry-api prod — no version pinned
- com.yahoo.vespa:vespajlib prod — no sources jar (404)
- org.eclipse.jetty:jetty-alpn-java-server prod — no version pinned
- org.eclipse.jetty:jetty-alpn-server prod — no version pinned
- org.eclipse.jetty:jetty-client prod — no version pinned
- org.eclipse.jetty:jetty-http prod — no version pinned
- org.eclipse.jetty.http2:jetty-http2-common prod — no version pinned
- org.eclipse.jetty.http2:jetty-http2-server prod — no version pinned
- org.eclipse.jetty:jetty-io prod — no version pinned
- org.eclipse.jetty:jetty-jmx prod — no version pinned
- org.eclipse.jetty:jetty-server prod — no version pinned
- org.eclipse.jetty:jetty-util prod — no version pinned
- com.yahoo.vespa:container-opentelemetry prod — no sources jar (404)
- com.microsoft.onnxruntime:onnxruntime prod — no version pinned
- com.google.guava:guava prod — no version pinned
- org.apache.maven:maven-archiver prod — no version pinned
- org.apache.maven.plugins:maven-shade-plugin prod — no sources jar (404)
- org.twdata.maven:mojo-executor prod — no version pinned
- com.yahoo.vespa:annotations prod — no sources jar (404)
- com.fasterxml.jackson.core:jackson-core prod — no version pinned
- com.yahoo.vespa:config prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:main prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:artifact-version-for-exports prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:export-packages-lib prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:non-public-api-usage prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:artifact-version-for-exports-dep prod — no sources jar (404)
- javax.xml.bind:jaxb-api prod — no version pinned
- com.yahoo.vespa.bundle-plugin:vespa-jar-using-non-public-api prod — no sources jar (404)
- com.yahoo.vespa:tenant-cd-api prod — no version pinned
- com.yahoo.vespa:security-utils prod — no version pinned
- com.yahoo.vespa:hosted-zone-api prod — no sources jar (404)
- org.slf4j:slf4j-api prod — no version pinned
- com.yahoo.vespa:hosted-api prod — no version pinned
- com.yahoo.vespa:tenant-cd-commons prod — no version pinned
- com.yahoo.vespa:jdisc_core prod — no sources jar (404)
- org.apache.commons:commons-compress prod — no sources jar (404)
- org.opentest4j:opentest4j prod — no sources jar (404)
- org.apiguardian:apiguardian-api prod — no version pinned
- org.junit.platform:junit-platform-commons prod — no sources jar (404)
- com.yahoo.vespa:vespa-feed-client-api prod — no version pinned
- com.yahoo.vespa:vespa-feed-client prod — no version pinned
- com.yahoo.vespa:component prod — no version pinned
- com.yahoo.vespa:config-application-package prod — no version pinned
- com.yahoo.vespa:zookeeper-server-common prod — no sources jar (404)
- com.yahoo.vespa:vespalog prod — no sources jar (404)
- com.yahoo.vespa:defaults prod — no sources jar (404)
- com.yahoo.vespa:vdslib prod — no sources jar (404)
- com.yahoo.vespa:zookeeper-client-common prod — no sources jar (404)
- com.yahoo.vespa:config-bundle prod — no sources jar (404)
- com.yahoo.vespa:config-lib prod — no sources jar (404)
- at.yawk.lz4:lz4-java prod — no version pinned
- com.yahoo.vespa:configgen prod — no sources jar (404)
- com.yahoo.vespa:configdefinitions prod — no sources jar (404)
- com.yahoo.vespa:provided-dependencies prod — no sources jar (404)
- com.yahoo.vespa:container-onnxruntime prod — no sources jar (404)
- com.google.protobuf:protobuf-java prod — no sources jar (404)
- com.yahoo.vespa:metrics prod — no sources jar (404)
- com.yahoo.vespa:metrics-proxy prod — no sources jar (404)
- com.yahoo.vespa:container-disc prod — no sources jar (404)
- com.yahoo.vespa:container-documentapi prod — no sources jar (404)
- com.yahoo.vespa:messagebus prod — no sources jar (404)
- com.yahoo.vespa:document prod — no sources jar (404)
- com.yahoo.vespa:linguistics prod — no sources jar (404)
- com.yahoo.vespa:container-messagebus prod — no sources jar (404)
- com.yahoo.vespa:searchlib prod — no sources jar (404)
- com.yahoo.vespa:docproc prod — no sources jar (404)
- com.yahoo.vespa:container-search prod — no sources jar (404)
- com.yahoo.vespa:container-search-and-docproc prod — no sources jar (404)
- com.yahoo.vespa:logd prod — no sources jar (404)
- com.yahoo.vespa:searchcore prod — no sources jar (404)
- com.yahoo.vespa:storage prod — no sources jar (404)
- com.yahoo.vespa:vsm prod — no sources jar (404)
- com.yahoo.vespa:vespaclient-core prod — no sources jar (404)
- com.yahoo.vespa:indexinglanguage prod — no sources jar (404)
- com.yahoo.vespa:searchsummary prod — no sources jar (404)
- com.yahoo.vespa:fat-model-dependencies prod — no sources jar (404)
- org.apache.httpcomponents.client5:httpclient5 prod — no version pinned
- org.apache.httpcomponents.core5:httpcore5 prod — no version pinned
- org.slf4j:slf4j-jdk14 prod — no version pinned
- io.airlift:aircompressor prod — no version pinned
- com.google.inject:guice prod — no version pinned
- org.apache.httpcomponents:httpclient prod — no version pinned
- org.apache.httpcomponents:httpmime prod — no version pinned
- commons-codec:commons-codec prod — no version pinned
- org.apache.httpcomponents.core5:httpcore5-h2 prod — no version pinned
- javax.servlet:javax.servlet-api prod — no version pinned
- net.java.dev.jna:jna prod — no version pinned
- com.yahoo.vespa:filedistribution prod — no sources jar (404)
- com.yahoo.vespa:model-evaluation prod — no sources jar (404)
- com.yahoo.vespa:vespa-3party-bundles prod — no sources jar (404)
- com.yahoo.vespa:opennlp-linguistics prod — no sources jar (404)
- com.yahoo.vespa:predicate-search-core prod — no sources jar (404)
- io.modelcontextprotocol.sdk:mcp prod — no sources jar (404)
- com.yahoo.vespa:fileacquirer prod — no sources jar (404)
- com.fasterxml.jackson.datatype:jackson-datatype-jsr310 prod — no version pinned
- com.fasterxml.jackson.datatype:jackson-datatype-jdk8 prod — no version pinned
- com.yahoo.vespa:documentapi prod — no sources jar (404)
- com.yahoo.vespa:documentapi-dependencies prod — no sources jar (404)
- io.github.arnej27959:jllama prod — no version pinned
- io.opentelemetry:opentelemetry-context prod — no version pinned
- io.opentelemetry:opentelemetry-common prod — no version pinned
- io.opentelemetry:opentelemetry-sdk prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-common prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-trace prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-metrics prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-logs prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-common prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-otlp-common prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-otlp prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-sender-jdk prod — no version pinned
- com.yahoo.vespa:fsa prod — no sources jar (404)
- com.google.re2j:re2j prod — no version pinned
- org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle prod — no version pinned
- com.yahoo.vespa:application prod — no sources jar (404)
- org.bouncycastle:bcpkix-jdk18on prod — no version pinned
- com.yahoo.vespa:vespaclient-container-plugin prod — no sources jar (404)
- io.airlift:airline prod — no version pinned
- net.openhft:zero-allocation-hashing prod — no version pinned
- org.json:json prod — no version pinned
- org.apache.logging.log4j:log4j-api prod — no sources jar (404)
- org.apache.logging.log4j:log4j-core prod — no sources jar (404)
- org.yaml:snakeyaml prod — no sources jar (404)
- org.eclipse.lemminx:org.eclipse.lemminx prod — no sources jar (404)
- org.testcontainers:testcontainers prod — no sources jar (404)
- javax.ws.rs:javax.ws.rs-api prod — no version pinned
- com.sun.xml.bind:jaxb-core prod — no version pinned
- com.sun.xml.bind:jaxb-impl prod — no version pinned
- com.sun.activation:javax.activation prod — no version pinned
- aopalliance:aopalliance prod — no version pinned
- org.apache.felix:org.apache.felix.resolver prod — no sources jar (404)
- org.apache.felix:org.apache.felix.bundlerepository prod — no sources jar (404)
- org.slf4j:jcl-over-slf4j prod — no version pinned
- org.slf4j:log4j-over-slf4j prod — no version pinned
- ai.djl.huggingface:tokenizers prod — no version pinned
- org.apache.lucene:lucene-core prod — no version pinned
- org.apache.lucene:lucene-analysis-common prod — no version pinned
- io.prometheus:simpleclient prod — no version pinned
- io.prometheus:simpleclient_common prod — no version pinned
- org.apache.velocity:velocity-engine-core prod — no version pinned
- com.openai:openai-java prod — no sources jar (404)
- com.fasterxml.jackson.module:jackson-module-kotlin prod — no sources jar (404)
- com.squareup.okhttp3:okhttp prod — no sources jar (404)
- io.grpc:grpc-netty-shaded prod — no sources jar (404)
- io.grpc:grpc-protobuf prod — no sources jar (404)
- io.grpc:grpc-stub prod — no sources jar (404)
- com.dev-smart:ubjson prod — no version pinned
- org.eclipse.collections:eclipse-collections prod — no version pinned
- org.eclipse.collections:eclipse-collections-api prod — no version pinned
- org.apache.datasketches:datasketches-java prod — no sources jar (404)
- org.apache.datasketches:datasketches-memory prod — no sources jar (404)
- com.google.jimfs:jimfs prod — no version pinned
- org.apache.maven.shared:maven-dependency-tree prod — no version pinned
- org.eclipse.jetty.http2:jetty-http2-client-transport prod — no version pinned
- commons-cli:commons-cli prod — no version pinned
- org.apache.curator:curator-recipes prod — no version pinned
- com.yahoo.vespa:${zookeeper.client.artifactId} prod — no sources jar (404)
- com.yahoo.vespa:zookeeper-common prod — no sources jar (404)
- org.slf4j:slf4j-simple prod — no sources jar (404)
- io.dropwizard.metrics:metrics-core prod — no version pinned
- org.xerial.snappy:snappy-java prod — no version pinned