Shrink Dependencies#19002
Conversation
7a3a35d to
ce02d76
Compare
|
thank you for taking care of this! |
|
Yeah I plan on trying to address these broken checks shortly. You should see updated to this PR soon, and hopefully everything passes 😅 |
Update licenses.yaml for all 9 bumped dependency versions: Caffeine 2.9.3, Error Prone 2.36.0, Commons Codec 1.19.0, Commons IO 2.21.0, Commons Compress 1.28.0, Bouncy Castle 1.82, Netty 4.2.7.Final, HttpClient 4.5.14, Zstd JNI 1.5.6-6 Addresses static-checks-maven and validate-dist failures. Partial fix for apache#18998
| <groupId>com.github.luben</groupId> | ||
| <artifactId>zstd-jni</artifactId> | ||
| <version>1.5.2-3</version> | ||
| <version>1.5.6-6</version> |
There was a problem hiding this comment.
[P2] Update ZSTD size-sensitive tests for the zstd-jni bump
Bumping zstd-jni to 1.5.6-6 changes the native compressor used by the ZSTD test path, but the PR leaves the exact serialized-size assertions in BlockCompressedPayloadWriterReaderTest and CellWriterReaderTest unchanged. The prepared packet already notes BlockCompressedPayloadWriterReaderTest is broken by this upgrade, so the processing tests remain failing unless the expected sizes are updated or the ZSTD assertions stop depending on exact compressed length.
| </dependency> | ||
| <dependency> | ||
| <groupId>com.google.api.grpc</groupId> | ||
| <artifactId>proto-google-common-protos</artifactId> |
There was a problem hiding this comment.
[P2] Update licenses.yaml for newly managed transitive versions
This PR manages proto-google-common-protos at 2.48.0 and kotlin-stdlib-jdk8 at 1.9.25, but licenses.yaml still registers proto-google-common-protos as 2.28.0 and kotlin-stdlib-jdk8 under the 1.8.21 entry. distribution/bin/check-licenses.py keys licenses by exact groupId/artifactId/version, so the apache-release license check can report these new versions as missing unless licenses.yaml is updated.
3 participants
Fixes #18998.
Description
PR #18990 introduced the
requireUpperBoundDepsenforcer rule to catch transitive dependency version inconsistencies. However, it needed 38 exclusions to pass, since many libraries pull in conflicting transitive versions. This PR shrinks that list from 38 down to 18 by bumping dependency versions to satisfy the upper bound constraints.Bumped dependency versions
The following dependencies were bumped to the highest version required by their transitive dependency tree. All bumps are patch or minor version increments with no expected API breakages:
Added new managed dependencies
These transitive dependencies were not previously managed in the root POM, causing version conflicts. Adding them to
dependencyManagementcentralizes version control and removes the need for exclusions:kotlin-stdlib-jdk8(1.9.25) — aligns with existingkotlin-stdlibproto-google-common-protos(2.48.0) — version moved fromindexing-service/pom.xmljakarta.activation-api(1.2.2) — fixes conflict between docker-java and jettyhttpclient5(5.5.1) — version moved fromembedded-tests/pom.xmlhttpcore5(5.3.6) — required byhttpclient55.5.1Child POM cleanup
Removed hardcoded versions from child modules that are now centrally managed:
indexing-service/pom.xml:proto-google-common-protosversion removedembedded-tests/pom.xml:httpclient5version removedRemaining exclusions
The 18 remaining exclusions all require major version bumps or involve complex dependency trees that need separate, focused work:
Each remaining exclusion is documented inline with a comment explaining why it is still needed.
Release note
Upgraded multiple transitive dependency versions (Netty, Commons IO, Commons Compress, Caffeine, Bouncy Castle, and others) and reduced the number of
requireUpperBoundDepsenforcer exclusions from 38 to 18. No user-facing behavior changes.Key changed/added classes in this PR
pom.xml— version bumps, new managed dependencies, reduced enforcer exclusionsindexing-service/pom.xml— removed hardcodedproto-google-common-protosversionembedded-tests/pom.xml— removed hardcodedhttpclient5versionThis PR has: