refactor(dependencies): remove unused commons-io and commons-collections4 from shenyu-admin #7607

Activity

1. Aias00

   added

   type: dependenciesPull requests that update a dependency filePull requests that update a dependency file

   type: refactor

   priority: mediumMedium severityMedium severity

   on Oct 13, 2026
2. github-actions commented on Oct 13, 2026

   

   github-actionsBot

   on Oct 13, 2026 – with GitHub Actions

   Contributor

   More actions

   👋 Hello @Aias00

   A new issue has been opened by @Aias00:

   • Title: refactor(dependencies): remove unused commons-io and commons-collections4 from shenyu-admin
   • Link: refactor(dependencies): remove unused commons-io and commons-collections4 from shenyu-admin #7607

   Please review when you have time. Thank you! 🙏
3. konlue commented on Oct 14, 2026

   

   konlue

   on Oct 14, 2026

   Contributor

   More actions

   Hi @Aias00, I'd like to take this one. While verifying on master I found the issue's evidence doesn't match the current code (though I may be missing something on my end), so I'd like to confirm a revised scope before sending a PR. All commands below are copy-paste reproducible on master.

   1. commons-io looks used in shenyu-admin

   $ git grep -n "org.apache.commons.io" -- shenyu-admin
   shenyu-admin/src/main/java/org/apache/shenyu/admin/mode/cluster/filter/ClusterForwardFilter.java:25:import org.apache.commons.io.IOUtils;
   shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java:23:import org.apache.commons.io.IOUtils;
   

   Call site 1 — ClusterForwardFilter.java#L143-L151, IOUtils.copy at L148:

        copyHeaders(responseEntity.getHeaders(), response);
        // fix cors error
        response.addHeader("Access-Control-Allow-Origin", "*");
        response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
        // write response back
        IOUtils.copy(new ByteArrayInputStream(Objects.requireNonNull(responseEntity.getBody())), response.getOutputStream());
        response.getOutputStream().flush();

   Call site 2 — SandboxServiceImpl.java#L118-L126, IOUtils.copy at L123:

                response.addHeader("sandbox-beforesign", UriUtils.encode(signContentWithoutSecret, StandardCharsets.UTF_8));
                response.addHeader("sandbox-sign", UriUtils.encode(sign, StandardCharsets.UTF_8));
            }
   
            IOUtils.copy(body.byteStream(), response.getOutputStream());
            response.flushBuffer();

   If these two usages are real, removing the commons-io dependency as-is would break compilation. Would it be acceptable to first replace both IOUtils.copy calls with org.springframework.util.StreamUtils.copy (already on the classpath via spring-core, and closer to the coding guideline of preferring project/framework utils), and then remove the dependency block from shenyu-admin/pom.xml (L295-L299)?

   2. commons-collections4 is used by 65 files, not 2

   $ git grep -l "org.apache.commons.collections4" -- shenyu-admin | wc -l
   65
   

   The two files named in the issue are indeed among them, but so are core listeners/aspect/controller code, e.g. AbstractDataChangedListener.java#L30, HttpLongPollingDataChangedListener.java#L21, WebsocketCollector.java#L22:

   first 15 of the 65 importing files

   shenyu-admin/src/main/java/org/apache/shenyu/admin/aspect/DataPermissionAspect.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/config/properties/DashboardProperties.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AiProxyApiKeyController.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ApiDocController.java          <- named in the issue
   shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/DashboardUserController.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/discovery/DiscoveryDataChangedEventSyncListener.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/disruptor/executor/RegisterServerConsumerExecutor.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/disruptor/subscriber/URIRegisterExecutorSubscriber.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/listener/AbstractDataChangedListener.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/listener/AiProxySelectorResolverInvalidator.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/listener/http/HttpLongPollingDataChangedListener.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/listener/websocket/WebsocketCollector.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/listener/websocket/WebsocketDataChangedListener.java
   shenyu-admin/src/main/java/org/apache/shenyu/admin/model/vo/SelectorConditionVO.java
   

   So removing commons-collections4 is not feasible now. And even in the future it wouldn't unlock via the apidoc cleanup: as of writing, #7592 and #7593 are still open — the removal hasn't started (per #7592 it also needs a coordinated removal of the dashboard-side UI, shenyu-dashboard#719, in the same release train) — and even once that lands, 60+ of the 65 usages remain. I'd suggest keeping commons-collections4 and narrowing this issue's scope to commons-io only.

   3. <commons-io.version> is not an orphaned property

   It's referenced by two other modules, so the property must stay; only shenyu-admin's dependency block goes away:

   $ grep -rn "commons-io.version" --include="pom.xml" .
   pom.xml:146:        <commons-io.version>2.11.0</commons-io.version>
   shenyu-admin/pom.xml:298:            <version>${commons-io.version}</version>
   shenyu-plugin/shenyu-plugin-security/shenyu-plugin-cryptor/pom.xml:32:            <version>${commons-io.version}</version>
   shenyu-protocol/shenyu-protocol-tcp/pom.xml:53:            <version>${commons-io.version}</version>
   

   e.g. shenyu-plugin-cryptor/pom.xml#L29-L33 and shenyu-protocol-tcp/pom.xml#L50-L54.

   Revised plan

   If this scope sounds right, I'll send a PR that: (1) replaces the two IOUtils.copy call sites with StreamUtils.copy (identical semantics: buffered copy, stream left open for the caller), (2) removes the commons-io dependency from shenyu-admin/pom.xml only, (3) keeps ${commons-io.version} for cryptor/protocol-tcp. Verified with mvn -pl shenyu-admin dependency:analyze and a green build. Happy to adjust if you'd rather keep commons-io and leave the call sites untouched.
4. konlue

   added a commit that references this issue on Oct 20, 2026

   refactor(admin): drop commons-io by replacing two IOUtils.copy call s…

   ...

   dcabf87
5. Aias00

   added a commit that references this issue on Oct 21, 2026

   refactor(admin): drop commons-io by replacing two IOUtils.copy call s…

   ...

   cc9a69a
6. Aias00

   closed this as completedin #7887on Oct 21, 2026