You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@druid.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 23:58:47 UTC

[PR] build(deps): bump org.apache.maven.resolver:maven-resolver-api from 1.3.1 to 2.0.23 (druid)

dependabot[bot] opened a new pull request, #20373:
URL: https://github.com/apache/druid/pull/20373

   Bumps [org.apache.maven.resolver:maven-resolver-api](https://github.com/apache/maven-resolver) from 1.3.1 to 2.0.23.
   <details>
   <summary>Release notes</summary>
   <p><em>Sourced from <a href="https://github.com/apache/maven-resolver/releases">org.apache.maven.resolver:maven-resolver-api's releases</a>.</em></p>
   <blockquote>
   <h2>2.0.23</h2>
   <!-- raw HTML omitted -->
   <h2>🚀 New features and improvements</h2>
   <ul>
   <li>Finish the repo key story (<a href="https://redirect.github.com/apache/maven-resolver/pull/2135">#2135</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix: log only once the warning in DefRemoteRepoMan (<a href="https://redirect.github.com/apache/maven-resolver/pull/2100">#2100</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2058">#2058</a>: Add links to configuration page (<a href="https://redirect.github.com/apache/maven-resolver/pull/2060">#2060</a>) <a href="https://github.com/Jamison929611"><code>@Jamison929611</code></a></li>
   <li>Eliminate per-node HashSet allocation in PathConflictResolver (<a href="https://redirect.github.com/apache/maven-resolver/pull/2075">#2075</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   </ul>
   <h2>🐛 Bug Fixes</h2>
   <ul>
   <li>fix: accept locally cached artifacts via same-id fallback when tracking URL changes (<a href="https://redirect.github.com/apache/maven-resolver/pull/2133">#2133</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and test flakiness (<a href="https://redirect.github.com/apache/maven-resolver/issues/1350">#1350</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2108">#2108</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li><a href="https://issues.apache.org/jira/browse/MRESOLVER-379">[MRESOLVER-379]</a> - Preserve relocated candidates from version ranges (<a href="https://redirect.github.com/apache/maven-resolver/pull/2114">#2114</a>) <a href="https://github.com/jjj-n"><code>@jjj-n</code></a></li>
   <li>Create the local repository directory before resolving its real path (<a href="https://redirect.github.com/apache/maven-resolver/pull/2111">#2111</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Optimize TrackingFileManager unit tests and fix potential lock leaks (<a href="https://redirect.github.com/apache/maven-resolver/issues/2094">#2094</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2102">#2102</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Validate the repository key used in checksum summary file names (<a href="https://redirect.github.com/apache/maven-resolver/pull/2099">#2099</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>fix: bound response reads and sanitize remote-derived strings (<a href="https://redirect.github.com/apache/maven-resolver/pull/2081">#2081</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: earn trust labels through verification and bind tracking to URL (<a href="https://redirect.github.com/apache/maven-resolver/pull/2080">#2080</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: bind credentials to origin and reject TLS downgrade redirects (<a href="https://redirect.github.com/apache/maven-resolver/pull/2085">#2085</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: prevent remote signals from weakening operator-configured policy (<a href="https://redirect.github.com/apache/maven-resolver/pull/2082">#2082</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: atomic file publication and authenticated IPC lock daemon (<a href="https://redirect.github.com/apache/maven-resolver/pull/2083">#2083</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: deploy-side integrity must fail closed (<a href="https://redirect.github.com/apache/maven-resolver/pull/2084">#2084</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: harden opt-in transport and lock backends against unauthenticated infrastructure (<a href="https://redirect.github.com/apache/maven-resolver/pull/2086">#2086</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Compose named lock keys one segment per coordinate field (<a href="https://redirect.github.com/apache/maven-resolver/pull/2091">#2091</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Resolve file transport locations with path operations instead of substring matching (<a href="https://redirect.github.com/apache/maven-resolver/pull/2088">#2088</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Validate coordinate components in the Maven 2 layout and local path composer (<a href="https://redirect.github.com/apache/maven-resolver/pull/2087">#2087</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   </ul>
   <h2>📝 Documentation updates</h2>
   <ul>
   <li>[docs] Clarify trusted checksum sources (<a href="https://redirect.github.com/apache/maven-resolver/pull/2127">#2127</a>) <a href="https://github.com/jiteshkhatri11"><code>@jiteshkhatri11</code></a></li>
   <li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2058">#2058</a>: Add links to configuration page (<a href="https://redirect.github.com/apache/maven-resolver/pull/2060">#2060</a>) <a href="https://github.com/Jamison929611"><code>@Jamison929611</code></a></li>
   </ul>
   <h2>👻 Maintenance</h2>
   <ul>
   <li>test: move from minio docker image (<a href="https://redirect.github.com/apache/maven-resolver/pull/2140">#2140</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and test flakiness (<a href="https://redirect.github.com/apache/maven-resolver/issues/1350">#1350</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2108">#2108</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Fix: tidy up f013 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2104">#2104</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2096">#2096</a>: harden NamedLocksTrackingFileManagerTest against CI load (<a href="https://redirect.github.com/apache/maven-resolver/pull/2098">#2098</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Carry repository provenance into aggregateRepositories (<a href="https://redirect.github.com/apache/maven-resolver/pull/2090">#2090</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Validate the repository key used as a local repository path segment (<a href="https://redirect.github.com/apache/maven-resolver/pull/2089">#2089</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   </ul>
   <h2>📦 Dependency updates</h2>
   <ul>
   <li>Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2136">#2136</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump version.slf4j from 2.0.18 to 2.0.19 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2130">#2130</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2131">#2131</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2129">#2129</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Deps: bump to BC provider 1.85.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2097">#2097</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2074">#2074</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   </ul>
   <!-- raw HTML omitted -->
   </blockquote>
   <p>... (truncated)</p>
   </details>
   <details>
   <summary>Commits</summary>
   <ul>
   <li><a href="https://github.com/apache/maven-resolver/commit/3cc91ea267616918bc6e2a17417edf053f8e92dc"><code>3cc91ea</code></a> [maven-release-plugin] prepare release maven-resolver-2.0.23</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/b703cdbb98d57b1a98c39c7721b7c934937b9a69"><code>b703cdb</code></a> Finish the repo key story (<a href="https://redirect.github.com/apache/maven-resolver/issues/2135">#2135</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/a719e8d0113312563b3647877f0dbc5947e4fed6"><code>a719e8d</code></a> test: move from minio docker image (<a href="https://redirect.github.com/apache/maven-resolver/issues/2140">#2140</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/d1d8d940a94c20b04306e6e6214d316e42501948"><code>d1d8d94</code></a> Bump org.apache.maven.plugin-tools:maven-plugin-tools-api (<a href="https://redirect.github.com/apache/maven-resolver/issues/2136">#2136</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/18753daa30739a699ea56e30865e8de7f4e58369"><code>18753da</code></a> fix: accept legacy ID-only tracking entries via backward-compatible fallback ...</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/0a74153d40a5982adf2d6a7ee45ac0a6fccff7a3"><code>0a74153</code></a> Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and ...</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/bd7421fc65fffff6ad3054cae7634441f622df1a"><code>bd7421f</code></a> [docs] Clarify trusted checksum sources (<a href="https://redirect.github.com/apache/maven-resolver/issues/2127">#2127</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/534e16e8fb161a82f36a3a863b526340389c68cb"><code>534e16e</code></a> [MRESOLVER-379] Preserve relocated range candidates (<a href="https://redirect.github.com/apache/maven-resolver/issues/2114">#2114</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/f786540666bc450132bf08dc7832f5d9d768669b"><code>f786540</code></a> Bump version.slf4j from 2.0.18 to 2.0.19 (<a href="https://redirect.github.com/apache/maven-resolver/issues/2130">#2130</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/dec4ec3e908c68fa2ee3b6e41d2c2afcaf998f3d"><code>dec4ec3</code></a> Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (<a href="https://redirect.github.com/apache/maven-resolver/issues/2131">#2131</a>)</li>
   <li>Additional commits viewable in <a href="https://github.com/apache/maven-resolver/compare/maven-resolver-1.3.1...maven-resolver-2.0.23">compare view</a></li>
   </ul>
   </details>
   <br />
   
   
   [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache.maven.resolver:maven-resolver-api&package-manager=maven&previous-version=1.3.1&new-version=2.0.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
   
   Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
   
   [//]: # (dependabot-automerge-start)
   [//]: # (dependabot-automerge-end)
   
   ---
   
   <details>
   <summary>Dependabot commands and options</summary>
   <br />
   
   You can trigger Dependabot actions by commenting on this PR:
   - `@dependabot rebase` will rebase this PR
   - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
   - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
   - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
   
   
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-api from 1.3.1 to 2.0.23 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 closed pull request #20373: build(deps): bump org.apache.maven.resolver:maven-resolver-api from 1.3.1 to 2.0.23
URL: https://github.com/apache/druid/pull/20373


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-api from 1.3.1 to 2.0.23 (druid)

Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.

dependabot[bot] commented on PR #20373:
URL: https://github.com/apache/druid/pull/20373#issuecomment-5724789807

   OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. You can also ignore all major, minor, or patch releases for a dependency by adding an [`ignore` condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired `update_types` to your config file.
   
   If you change your mind, just re-open this PR and I'll resolve any conflicts on it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-api from 1.3.1 to 2.0.23 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 commented on PR #20373:
URL: https://github.com/apache/druid/pull/20373#issuecomment-5724785584

This is an automated review by Codex GPT-5.6 Luna(Max).

## ROUND_1 closure decision

Close this PR without approval. The requested `org.apache.maven.resolver:maven-resolver-api` upgrade from `1.3.1` to `2.0.23` is INCOMPATIBLE as submitted: it changes only the API module while Druid packages and runs the rest of the Maven Resolver stack at `1.3.1`. Apache Maven Resolver's published compatibility guidance requires non-Maven consumers to use the same version for the API, SPI, implementation, utilities, connectors, and transports. Aligning that stack, the Maven resolver provider, the session lifecycle, and Druid's license registry is a separate coordinated change and is too broad/risky for this one-line Dependabot PR.

## Release inventory and cumulative effect

The complete Maven Central metadata for `org.apache.maven.resolver:maven-resolver-api` was read from the official artifact repository. Inclusive of the source and target, it contains 73 published artifact versions and 72 transitions:

- `1.3.1` -> `1.3.2`, `1.3.3`, `1.4.0`, `1.4.1`, `1.4.2`, `1.6.1`, `1.6.2`, `1.6.3`, `1.7.0`, `1.7.1`, `1.7.2`, `1.7.3`, `1.8.0`, `1.8.1`, `1.8.2`.
- `1.9.0`, `1.9.1`, `1.9.2`, `1.9.4`, `1.9.5`, `1.9.6`, `1.9.7`, `1.9.8`, `1.9.10`, `1.9.11`, `1.9.12`, `1.9.13`, `1.9.14`, `1.9.15`, `1.9.16`, `1.9.17`, `1.9.18`, `1.9.19`, `1.9.20`, `1.9.21`, `1.9.22`, `1.9.23`, `1.9.24`, `1.9.25`, `1.9.26`, `1.9.27`.
- `2.0.0-alpha-1`, `2.0.0-alpha-2`, `2.0.0-alpha-3`, `2.0.0-alpha-5`, `2.0.0-alpha-6`, `2.0.0-alpha-7`, `2.0.0-alpha-8`, `2.0.0-alpha-10`, `2.0.0-alpha-11`.
- `2.0.0`, `2.0.1`, `2.0.2`, `2.0.3`, `2.0.4`, `2.0.5`, `2.0.6`, `2.0.7`, `2.0.8`, `2.0.9`, `2.0.10`, `2.0.11`, `2.0.13`, `2.0.14`, `2.0.15`, `2.0.16`, `2.0.17`, `2.0.18`, `2.0.20`, `2.0.21`, `2.0.22`, `2.0.23`.

Source tags that do not appear in the artifact metadata (`1.6.0`, `1.9.3`, `1.9.9`, `2.0.0-alpha-4`, `2.0.0-alpha-9`, `2.0.12`, and `2.0.19`) were not counted as published `maven-resolver-api` artifacts. The cumulative target effect includes the 2.0 major contract: `RepositorySystem` now extends `Closeable` and adds lifecycle/session methods; `RepositorySystemSession` adds closeable-session and lifecycle contracts; and the legacy `DefaultRepositorySystemSession()` path used by Druid is deprecated because it can leak resources. The 2.0.23 release also contains later resolver security and repository-integrity fixes, but this PR does not update the matching implementation, SPI, connector, or transport modules that would consume them.

## Compatibility categories

| Category | Decision | Evidence |
| --- | --- | --- |
| API/ABI | INCOMPATIBLE | Target `RepositorySystem` adds abstract `flattenDependencyNodes`, `createSessionBuilder`, `addOnSystemEndedHandler`, and `shutdown` methods and extends `Closeable`; target `RepositorySystemSession` adds lifecycle methods. Resolver's own API-compatibility contract says major versions do not provide backward compatibility. |
| Runtime | INCOMPATIBLE | `services/src/main/java/org/apache/druid/cli/PullDependencies.java` creates the service locator at lines 202-207, creates the legacy session at lines 210-214, and resolves dependencies at lines 364-373 without closing the system/session. The target's 2.x lifecycle contract is not adopted, while the implementation remains 1.3.1. |
| Configuration | SAFE | The PR changes no Druid configuration, CLI option, or default; only one Maven version is changed. |
| Serialization/wire | SAFE | No Druid wire format, serialized class, query protocol, or schema is changed by this metadata-only diff. |
| Persistence | SAFE | No Druid persistence format is changed; the existing extension/local-repository paths remain in source. Resolver local-repository behavior is not safely upgradeable independently of the rest of the stack. |
| Clients | CONCERN | `PullDependencies` is Druid's Maven Resolver network client and explicitly wires the 1.3.1 HTTP transport/connector into the target API path. |
| Transitive dependencies | INCOMPATIBLE | The current reactor dependency tree resolves `maven-resolver-api:2.0.23` but `maven-resolver-connector-basic`, `maven-resolver-transport-http`, `maven-resolver-util`, `maven-resolver-impl`, and `maven-resolver-spi` at `1.3.1`; `maven-resolver-provider:3.6.0` also brings the 1.3.1 stack. |
| Licenses | CONCERN | Both endpoint JARs are Apache-2.0, but target `META-INF/NOTICE` says `Copyright 2010-2026` while `licenses.yaml` lines 2109 and 2122-2124 register the grouped Resolver artifacts only at `1.3.1` with the 2001-2018 API notice. The target version/notice is not registered. |
| Extension/plugin SPI | INCOMPATIBLE | Druid's dependency graph exposes Resolver SPI and connector implementations at `1.3.1` beside API `2.0.23`; Apache's compatibility guide explicitly requires the API, SPI, impl, util, connector, and transport versions to match for applications outside Maven. |

## Druid impact and validation

The complete PR diff is one tracked line in `services/pom.xml`; no Druid production source or test file changed. The affected call sites are `PullDependencies.java` lines 35-59, 182-214, 327-372 and `PullDependenciesTest.java` lines 26-50, 96-156, 296-357. The source/test path still compiles and its existing behavior is covered, but that does not make the unsupported mixed Resolver module set safe.

Validation performed:

- `git diff --check`: passed.
- `mvn -ntp -pl services -DskipTests dependency:tree -Dverbose '-Dincludes=org.apache.maven.resolver:*'`: passed and showed the mixed versions above.
- `mvn -ntp -pl distribution -am -DskipTests dependency:tree -Dverbose '-Dincludes=org.apache.maven.resolver:*'`: passed and showed the same mixed versions in the packaged reactor.
- Focused reactor test `mvn -ntp test -pl services -am -Dtest="org.apache.druid.cli.PullDependenciesTest" -Dsurefire.failIfNoSpecifiedTests=false -Pskip-static-checks -Dweb.console.skip=true -T1C`: passed, 12 tests, 0 failures/errors/skips.
- Current generated `services/target/reports/dependencies.html` and `distribution/target/reports/dependencies.html`: confirmed `maven-resolver-api:2.0.23` and the other Resolver modules at `1.3.1`; target artifact inspection confirmed Apache-2.0 LICENSE/NOTICE.
- The standalone `check-licenses.py` invocation could not run locally because the environment lacks PyYAML (`ModuleNotFoundError: No module named 'yaml'`); the registry/report mismatch above was verified directly.

## CI and automation actions

Exact reserved/current head: `ae32b418bdb1a48177e50ea08263549073eba0f8`. The live PR was OPEN, non-draft, MERGEABLE/CLEAN with no prior reviews. The complete current rollup was 27 CheckRuns, all `COMPLETED/SUCCESS`, and 0 StatusContexts; there were no failed, pending, cancelled, skipped, neutral, or unknown items, so no failed-job diagnosis or rerun was needed. No worktree repair, commit, or push was made. No approval was submitted because compatibility was not SAFE. This closure is not a merge; no merge was performed.

Official evidence: [Maven Central metadata](https://repo1.maven.org/maven2/org/apache/maven/resolver/maven-resolver-api/maven-metadata.xml), [Resolver API compatibility guidance](https://github.com/apache/maven-resolver/blob/maven-resolver-2.0.23/src/site/markdown/api-compatibility.md), and [Resolver 1.x to 2.x upgrade guide](https://github.com/apache/maven-resolver/blob/maven-resolver-2.0.23/src/site/markdown/upgrading-resolver.md).

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org