You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@druid.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 23:56:41 UTC

[PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.23 (druid)

dependabot[bot] opened a new pull request, #20371:
URL: https://github.com/apache/druid/pull/20371

   Bumps [org.apache.maven.resolver:maven-resolver-impl](https://github.com/apache/maven-resolver) from 1.3.1 to 2.0.23.
   <details>
   <summary>Release notes</summary>
   <p><em>Sourced from <a href="https://github.com/apache/maven-resolver/releases">org.apache.maven.resolver:maven-resolver-impl's releases</a>.</em></p>
   <blockquote>
   <h2>2.0.23</h2>
   <!-- raw HTML omitted -->
   <h2>🚀 New features and improvements</h2>
   <ul>
   <li>Finish the repo key story (<a href="https://redirect.github.com/apache/maven-resolver/pull/2135">#2135</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix: log only once the warning in DefRemoteRepoMan (<a href="https://redirect.github.com/apache/maven-resolver/pull/2100">#2100</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2058">#2058</a>: Add links to configuration page (<a href="https://redirect.github.com/apache/maven-resolver/pull/2060">#2060</a>) <a href="https://github.com/Jamison929611"><code>@Jamison929611</code></a></li>
   <li>Eliminate per-node HashSet allocation in PathConflictResolver (<a href="https://redirect.github.com/apache/maven-resolver/pull/2075">#2075</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   </ul>
   <h2>🐛 Bug Fixes</h2>
   <ul>
   <li>fix: accept locally cached artifacts via same-id fallback when tracking URL changes (<a href="https://redirect.github.com/apache/maven-resolver/pull/2133">#2133</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and test flakiness (<a href="https://redirect.github.com/apache/maven-resolver/issues/1350">#1350</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2108">#2108</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li><a href="https://issues.apache.org/jira/browse/MRESOLVER-379">[MRESOLVER-379]</a> - Preserve relocated candidates from version ranges (<a href="https://redirect.github.com/apache/maven-resolver/pull/2114">#2114</a>) <a href="https://github.com/jjj-n"><code>@jjj-n</code></a></li>
   <li>Create the local repository directory before resolving its real path (<a href="https://redirect.github.com/apache/maven-resolver/pull/2111">#2111</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Optimize TrackingFileManager unit tests and fix potential lock leaks (<a href="https://redirect.github.com/apache/maven-resolver/issues/2094">#2094</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2102">#2102</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Validate the repository key used in checksum summary file names (<a href="https://redirect.github.com/apache/maven-resolver/pull/2099">#2099</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>fix: bound response reads and sanitize remote-derived strings (<a href="https://redirect.github.com/apache/maven-resolver/pull/2081">#2081</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: earn trust labels through verification and bind tracking to URL (<a href="https://redirect.github.com/apache/maven-resolver/pull/2080">#2080</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: bind credentials to origin and reject TLS downgrade redirects (<a href="https://redirect.github.com/apache/maven-resolver/pull/2085">#2085</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: prevent remote signals from weakening operator-configured policy (<a href="https://redirect.github.com/apache/maven-resolver/pull/2082">#2082</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: atomic file publication and authenticated IPC lock daemon (<a href="https://redirect.github.com/apache/maven-resolver/pull/2083">#2083</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: deploy-side integrity must fail closed (<a href="https://redirect.github.com/apache/maven-resolver/pull/2084">#2084</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>fix: harden opt-in transport and lock backends against unauthenticated infrastructure (<a href="https://redirect.github.com/apache/maven-resolver/pull/2086">#2086</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Compose named lock keys one segment per coordinate field (<a href="https://redirect.github.com/apache/maven-resolver/pull/2091">#2091</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Resolve file transport locations with path operations instead of substring matching (<a href="https://redirect.github.com/apache/maven-resolver/pull/2088">#2088</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Validate coordinate components in the Maven 2 layout and local path composer (<a href="https://redirect.github.com/apache/maven-resolver/pull/2087">#2087</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   </ul>
   <h2>📝 Documentation updates</h2>
   <ul>
   <li>[docs] Clarify trusted checksum sources (<a href="https://redirect.github.com/apache/maven-resolver/pull/2127">#2127</a>) <a href="https://github.com/jiteshkhatri11"><code>@jiteshkhatri11</code></a></li>
   <li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2058">#2058</a>: Add links to configuration page (<a href="https://redirect.github.com/apache/maven-resolver/pull/2060">#2060</a>) <a href="https://github.com/Jamison929611"><code>@Jamison929611</code></a></li>
   </ul>
   <h2>👻 Maintenance</h2>
   <ul>
   <li>test: move from minio docker image (<a href="https://redirect.github.com/apache/maven-resolver/pull/2140">#2140</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and test flakiness (<a href="https://redirect.github.com/apache/maven-resolver/issues/1350">#1350</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2108">#2108</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Fix: tidy up f013 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2104">#2104</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2096">#2096</a>: harden NamedLocksTrackingFileManagerTest against CI load (<a href="https://redirect.github.com/apache/maven-resolver/pull/2098">#2098</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Carry repository provenance into aggregateRepositories (<a href="https://redirect.github.com/apache/maven-resolver/pull/2090">#2090</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   <li>Validate the repository key used as a local repository path segment (<a href="https://redirect.github.com/apache/maven-resolver/pull/2089">#2089</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
   </ul>
   <h2>📦 Dependency updates</h2>
   <ul>
   <li>Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2136">#2136</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump version.slf4j from 2.0.18 to 2.0.19 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2130">#2130</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2131">#2131</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2129">#2129</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Deps: bump to BC provider 1.85.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2097">#2097</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2074">#2074</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   </ul>
   <!-- raw HTML omitted -->
   </blockquote>
   <p>... (truncated)</p>
   </details>
   <details>
   <summary>Commits</summary>
   <ul>
   <li><a href="https://github.com/apache/maven-resolver/commit/3cc91ea267616918bc6e2a17417edf053f8e92dc"><code>3cc91ea</code></a> [maven-release-plugin] prepare release maven-resolver-2.0.23</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/b703cdbb98d57b1a98c39c7721b7c934937b9a69"><code>b703cdb</code></a> Finish the repo key story (<a href="https://redirect.github.com/apache/maven-resolver/issues/2135">#2135</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/a719e8d0113312563b3647877f0dbc5947e4fed6"><code>a719e8d</code></a> test: move from minio docker image (<a href="https://redirect.github.com/apache/maven-resolver/issues/2140">#2140</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/d1d8d940a94c20b04306e6e6214d316e42501948"><code>d1d8d94</code></a> Bump org.apache.maven.plugin-tools:maven-plugin-tools-api (<a href="https://redirect.github.com/apache/maven-resolver/issues/2136">#2136</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/18753daa30739a699ea56e30865e8de7f4e58369"><code>18753da</code></a> fix: accept legacy ID-only tracking entries via backward-compatible fallback ...</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/0a74153d40a5982adf2d6a7ee45ac0a6fccff7a3"><code>0a74153</code></a> Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and ...</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/bd7421fc65fffff6ad3054cae7634441f622df1a"><code>bd7421f</code></a> [docs] Clarify trusted checksum sources (<a href="https://redirect.github.com/apache/maven-resolver/issues/2127">#2127</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/534e16e8fb161a82f36a3a863b526340389c68cb"><code>534e16e</code></a> [MRESOLVER-379] Preserve relocated range candidates (<a href="https://redirect.github.com/apache/maven-resolver/issues/2114">#2114</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/f786540666bc450132bf08dc7832f5d9d768669b"><code>f786540</code></a> Bump version.slf4j from 2.0.18 to 2.0.19 (<a href="https://redirect.github.com/apache/maven-resolver/issues/2130">#2130</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/dec4ec3e908c68fa2ee3b6e41d2c2afcaf998f3d"><code>dec4ec3</code></a> Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (<a href="https://redirect.github.com/apache/maven-resolver/issues/2131">#2131</a>)</li>
   <li>Additional commits viewable in <a href="https://github.com/apache/maven-resolver/compare/maven-resolver-1.3.1...maven-resolver-2.0.23">compare view</a></li>
   </ul>
   </details>
   <br />
   
   
   [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache.maven.resolver:maven-resolver-impl&package-manager=maven&previous-version=1.3.1&new-version=2.0.23)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
   
   Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
   
   [//]: # (dependabot-automerge-start)
   [//]: # (dependabot-automerge-end)
   
   ---
   
   <details>
   <summary>Dependabot commands and options</summary>
   <br />
   
   You can trigger Dependabot actions by commenting on this PR:
   - `@dependabot rebase` will rebase this PR
   - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
   - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
   - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
   
   
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.23 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 commented on PR #20371:
URL: https://github.com/apache/druid/pull/20371#issuecomment-5724845595

This is an automated review by Codex GPT-5.6 Luna(Max).

## Compatibility analysis

Dependency under review: `org.apache.maven.resolver:maven-resolver-impl`, source `1.3.1`, target `2.0.23`. The reserved and currently verified head is `2a94814ef6780db4df00672eac59b42e86c9a9d7`; the base commit is `2fed7ca11d9852412ce76798a3fa150ddae9afdb`. The PR diff is one line in `services/pom.xml`, changing only `maven-resolver-impl` from `1.3.1` to `2.0.23`; no Druid production or test source is changed.

The complete published Maven Central inventory for `maven-resolver-impl` from the source through the target is 73 versions: `1.3.1`, `1.3.2`, `1.3.3`, `1.4.0`, `1.4.1`, `1.4.2`, `1.6.1`, `1.6.2`, `1.6.3`, `1.7.0`, `1.7.1`, `1.7.2`, `1.7.3`, `1.8.0`, `1.8.1`, `1.8.2`, `1.9.0`, `1.9.1`, `1.9.2`, `1.9.4`, `1.9.5`, `1.9.6`, `1.9.7`, `1.9.8`, `1.9.10`, `1.9.11`, `1.9.12`, `1.9.13`, `1.9.14`, `1.9.15`, `1.9.16`, `1.9.17`, `1.9.18`, `1.9.19`, `1.9.20`, `1.9.21`, `1.9.22`, `1.9.23`, `1.9.24`, `1.9.25`, `1.9.26`, `1.9.27`, `2.0.0-alpha-1`, `2.0.0-alpha-2`, `2.0.0-alpha-3`, `2.0.0-alpha-5`, `2.0.0-alpha-6`, `2.0.0-alpha-7`, `2.0.0-alpha-8`, `2.0.0-alpha-10`, `2.0.0-alpha-11`, `2.0.0`, `2.0.1`, `2.0.2`, `2.0.3`, `2.0.4`, `2.0.5`, `2.0.6`, `2.0.7`, `2.0.8`, `2.0.9`, `2.0.10`, `2.0.11`, `2.0.13`, `2.0.14`, `2.0.15`, `2.0.16`, `2.0.17`, `2.0.18`, `2.0.20`, `2.0.21`, `2.0.22`, and `2.0.23`. `1.9.3`, `1.9.9`, `2.0.0-alpha-4`, `2.0.0-alpha-9`, `2.0.12`, and `2.0.19` are absent from the published M
aven Central metadata and were not treated as releases.

The 1.x chain was reviewed through `1.9.27`; the alpha bridge and every published 2.0.x patch release were reviewed through `2.0.23`. The 2.0.0 release notes document the `ServiceLocator` removal, session/bootstrap changes, transport restructuring, and the move from `java.io.File` to NIO paths. The 2.0.23 release notes add repository-key, tracking, checksum, redirect/TLS, policy, atomic-publication, lock, coordinate-validation, and remote-string-sanitization changes. The cumulative target effect is therefore a major resolver bootstrap/transport/session and local-repository behavior migration, not a compatible implementation-only patch.

Compatibility decisions:

| Category | Decision | Evidence |
| --- | --- | --- |
| API/ABI | INCOMPATIBLE | `DefaultServiceLocator` is present in the published 1.3.1 implementation jar and absent from the published 2.0.23 implementation jar. |
| Runtime | INCOMPATIBLE | The unchanged Druid bootstrap cannot compile; the target also requires the new supplier/transport arrangement. |
| Configuration | CONCERN | Druid's `MavenRepositorySystemUtils.newSession()` and proxy/local-repository setup need an intentional 2.0 session-builder migration. |
| Serialization/wire | SAFE for Druid data/query formats | The one-line PR changes no Druid serialization or query wire classes; Maven repository metadata/HTTP behavior is covered under clients/runtime. |
| Persistence | CONCERN | `pull-deps` writes a local Maven repository, while the 2.0 transition changes path/session/locking and the target hardens tracking, checksum, publication, and repository-key handling. |
| Clients | INCOMPATIBLE for the pull-deps repository client | Druid imports the 1.x `org.eclipse.aether.transport.http.HttpTransporterFactory`; no `maven-resolver-transport-http:2.0.23` artifact is published, and 2.0 uses replacement transport modules. |
| Transitive dependencies | INCOMPATIBLE | Enforcer reports direct `api`, `spi`, `util`, connector, and transport modules at `1.3.1` alongside `impl:2.0.23`; `impl:2.0.23` also requires `maven-resolver-named-locks`. |
| Licenses | CONCERN | Resolver artifacts are Apache-2.0, but `licenses.yaml` still records the old 1.3.1 resolver modules and Maven 3.6.0 provider; a real migration adds supplier, named-lock, replacement transport, and Maven-provider metadata to review. |
| Extension/plugin SPI | INCOMPATIBLE | `PullDependencies.java` and `PullDependenciesTest.java` directly use the removed locator and old connector/transport bootstrap APIs on the extension download path. |

Overall compatibility verdict: INCOMPATIBLE. A safe repair requires coordinated dependency alignment, a replacement supplier/session bootstrap, transport selection, provider/Maven model alignment, proxy/local-repository validation, license metadata, server packaging updates, and focused tests. That is a genuinely large and risky migration for this one-line Dependabot PR, so it is not safe to repair or approve in this round.

## Druid impact

The PR changes only `services/pom.xml` at the resolver implementation version. The affected unchanged call sites are `services/src/main/java/org/apache/druid/cli/PullDependencies.java` imports and `getRepositorySystem()` / `getRepositorySystemSession()` (the removed locator, old HTTP transporter, Maven session helper, proxy selector, and local repository manager), plus the equivalent real bootstrap in `services/src/test/java/org/apache/druid/cli/PullDependenciesTest.java`. `server/pom.xml` still declares resolver connector/transport/provider at the old versions and marks them as used dependencies for packaging. `licenses.yaml` still has the old resolver/provider entries. No tracked Druid source or test code changed in the PR.

## Validation

- `git diff --check` passed for the complete PR diff.
- Published-jar inspection confirmed `DefaultServiceLocator` in `maven-resolver-impl:1.3.1` and absent in `maven-resolver-impl:2.0.23`.
- Published-POM inspection confirmed `maven-resolver-impl:2.0.23` depends on the 2.0.23 API/SPI/util/named-locks set; the target supplier module brings the replacement connector, file/Apache transports, and Maven resolver provider, while the old HTTP transport GAV returns HTTP 404 at 2.0.23.
- All 20 failed job logs were inspected. The compile-failure jobs report `PullDependencies.java:[45,31]` and `[204,5]` cannot find `org.eclipse.aether.impl.DefaultServiceLocator`; the four static jobs report Maven Enforcer `RequireUpperBoundDeps` failures for the mixed 1.3.1/2.0.23 resolver graph.
- Attached artifacts were inspected: one web-check diagnostics artifact and 13 unit-report artifacts (about 75 MiB); the reports contain no independent JUnit `<failure>`/`<error>` result, and the small diagnostics artifacts are heap/jstack captures.

## CI gate

At the pre-closure refresh the PR was OPEN, non-draft, `MERGEABLE` with `UNSTABLE` merge state, exact head `2a94814ef6780db4df00672eac59b42e86c9a9d7`, 27 CheckRuns, 0 StatusContexts, and rollup `FAILURE`. Five CheckRuns succeeded: PR title, triage, CodeQL JavaScript, CodeQL Python, and actions-timeline. The 20 failures were:

- CodeQL: `Analyze (java)` — the `druid-services` compile break.
- Static Checks: `openrewrite`, `strict-compilation`, `packaging-check (25) / packaging-check-jdk25`, and `static-checks-maven` — the mixed resolver dependency graph fails upper-bound convergence.
- Static Checks: `web-checks` — the same `druid-services` compile break.
- Unit & Integration: `docker-tests / Run Docker tests`, `QTest 0/4`, `QTest 1/4`, `QTest 2/4`, `QTest 3/4`, and every JDK25 shard `test-jdk25-[C*]`, `test-jdk25-[S*]`, `test-jdk25-[K*,U*,Z*,Y*,X*]`, `test-jdk25-[N*,Q*]`, `test-jdk25-[I*,L*,J*]`, `test-jdk25-[M*,A*,V*,W*]`, `test-jdk25-[E*,G*,F*]`, `test-jdk25-[R*,B*,P*]`, and `test-jdk25-[H*,D*,T*,O*]` — the same compile break before those suites could run.

The remaining non-success items were `coverage-jacoco` SKIPPED, because prerequisites failed, and the aggregate CodeQL CheckRun NEUTRAL. These are not eligible grounds for approval; the rollup is not green.

## Automation actions

No CI reruns were issued: every completed failure was deterministic and PR-caused, so rerunning would not be evidence-backed; the rerun count remains 0/2 for every failed job on this exact head. No worktree source repair, commit, push, or approval was made. This PR is being closed as `CLOSED_INCOMPATIBLE` / high-effort migration, with the evidence above preserved for a future dedicated Resolver 2 migration. No merge was performed.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.23 (druid)

Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.

dependabot[bot] commented on PR #20371:
URL: https://github.com/apache/druid/pull/20371#issuecomment-5724846015

   OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. You can also ignore all major, minor, or patch releases for a dependency by adding an [`ignore` condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired `update_types` to your config file.
   
   If you change your mind, just re-open this PR and I'll resolve any conflicts on it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.23 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 closed pull request #20371: build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.23
URL: https://github.com/apache/druid/pull/20371


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org