[PR] build(deps): remove unused j2objc-annotations and curator-test dependencies (druid)

["ashwintumma23 (via GitHub)" <gi...@apache.org>]

ashwintumma23 opened a new pull request, #20329:
URL: https://github.com/apache/druid/pull/20329

   ## Summary
   
   Removes two unused third-party dependencies (`com.google.j2objc:j2objc-annotations`
   and `org.apache.curator:curator-test`) from modules where static analysis confirmed
   zero source usage, reducing attack surface and license exposure.
   
   ## Release note
   
   Removed unused `com.google.j2objc:j2objc-annotations` from root `dependencyManagement`
   and `org.apache.curator:curator-test` from 4 modules (`embedded-tests`,
   `rabbit-stream-indexing-service`, `druid-catalog`, `lookups-cached-global`) where
   no source usage was found.
   
   ---
   
   ### Key changed/added classes in this PR
   
   * `pom.xml`
   * `embedded-tests/pom.xml`
   * `extensions-contrib/rabbit-stream-indexing-service/pom.xml`
   * `extensions-core/druid-catalog/pom.xml`
   * `extensions-core/lookups-cached-global/pom.xml`
   * `licenses.yaml`
   
   ---
   
   ## Reason for change
   
   Keeping unused third-party dependencies increases attack surface and license exposure
   without benefit. Static analysis flagged both artifacts as unused, and manual
   investigation confirmed zero source imports in the affected modules.
   
   `curator-test` remains declared in the 4 modules that actively use it (`server`,
   `indexing-service`, `kafka-indexing-service`, `kafka-extraction-namespace`) and in
   root `dependencyManagement` for version pinning.
   
   `j2objc-annotations` is already managed by the Guava BOM (already imported), so the
   explicit `dependencyManagement` pin was a redundant no-op.
   
   ## Changes
   
   **1. pom.xml (1 entry removed)**
   
   * Removed `com.google.j2objc:j2objc-annotations` version `3.1` from
     `dependencyManagement` — redundant, as the Guava BOM already pins this artifact
     at the same version.
   
   **2. embedded-tests/pom.xml (1 entry removed)**
   
   * Removed unused `org.apache.curator:curator-test` test-scope dependency — zero
     `curator.test` / `TestingServer` / `TestingCluster` imports in source.
   
   **3. extensions-contrib/rabbit-stream-indexing-service/pom.xml (1 entry removed)**
   
   * Removed unused `org.apache.curator:curator-test` test-scope dependency — zero
     `curator.test` imports in source.
   
   **4. extensions-core/druid-catalog/pom.xml (1 entry removed)**
   
   * Removed unused `org.apache.curator:curator-test` test-scope dependency — zero
     `curator.test` imports in source.
   
   **5. extensions-core/lookups-cached-global/pom.xml (1 entry removed)**
   
   * Removed unused `org.apache.curator:curator-test` test-scope dependency (including
     its stale `javassist` exclusion) — zero `curator.test` imports in source.
   
   **6. licenses.yaml (2 sections removed)**
   
   * Removed `j2objc` entry for `core` module.
   * Removed `j2objc` entry for `extensions/protobuf-extensions` module.
   
   ## Tests
   
   * Verified zero `com.google.j2objc` and `curator.test` imports in all affected
     module source trees
   * `curator-test` remains declared and available in the modules that actively use it
   * No compile-time or runtime references to removed artifacts exist in the
     affected modules


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): remove unused j2objc-annotations and curator-test dependencies (druid)

["FrankChen021 (via GitHub)" <gi...@apache.org>]

FrankChen021 commented on PR #20329:
URL: https://github.com/apache/druid/pull/20329#issuecomment-5646319555

   can we strengenth the CI to find these problems ?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org