You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/18 00:00:16 UTC
[PR] build(deps): bump org.apache.maven.resolver:maven-resolver-spi from 1.3.1 to 2.0.23 (druid)
dependabot[bot] opened a new pull request, #20374:
URL: https://github.com/apache/druid/pull/20374
Bumps [org.apache.maven.resolver:maven-resolver-spi](https://github.com/apache/maven-resolver) from 1.3.1 to 2.0.23.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/apache/maven-resolver/releases">org.apache.maven.resolver:maven-resolver-spi's releases</a>.</em></p>
<blockquote>
<h2>2.0.23</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li>Finish the repo key story (<a href="https://redirect.github.com/apache/maven-resolver/pull/2135">#2135</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
<li>Fix: log only once the warning in DefRemoteRepoMan (<a href="https://redirect.github.com/apache/maven-resolver/pull/2100">#2100</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
<li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2058">#2058</a>: Add links to configuration page (<a href="https://redirect.github.com/apache/maven-resolver/pull/2060">#2060</a>) <a href="https://github.com/Jamison929611"><code>@Jamison929611</code></a></li>
<li>Eliminate per-node HashSet allocation in PathConflictResolver (<a href="https://redirect.github.com/apache/maven-resolver/pull/2075">#2075</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix: accept locally cached artifacts via same-id fallback when tracking URL changes (<a href="https://redirect.github.com/apache/maven-resolver/pull/2133">#2133</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and test flakiness (<a href="https://redirect.github.com/apache/maven-resolver/issues/1350">#1350</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2108">#2108</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/MRESOLVER-379">[MRESOLVER-379]</a> - Preserve relocated candidates from version ranges (<a href="https://redirect.github.com/apache/maven-resolver/pull/2114">#2114</a>) <a href="https://github.com/jjj-n"><code>@jjj-n</code></a></li>
<li>Create the local repository directory before resolving its real path (<a href="https://redirect.github.com/apache/maven-resolver/pull/2111">#2111</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>Optimize TrackingFileManager unit tests and fix potential lock leaks (<a href="https://redirect.github.com/apache/maven-resolver/issues/2094">#2094</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2102">#2102</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>Validate the repository key used in checksum summary file names (<a href="https://redirect.github.com/apache/maven-resolver/pull/2099">#2099</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>fix: bound response reads and sanitize remote-derived strings (<a href="https://redirect.github.com/apache/maven-resolver/pull/2081">#2081</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>fix: earn trust labels through verification and bind tracking to URL (<a href="https://redirect.github.com/apache/maven-resolver/pull/2080">#2080</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>fix: bind credentials to origin and reject TLS downgrade redirects (<a href="https://redirect.github.com/apache/maven-resolver/pull/2085">#2085</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>fix: prevent remote signals from weakening operator-configured policy (<a href="https://redirect.github.com/apache/maven-resolver/pull/2082">#2082</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>fix: atomic file publication and authenticated IPC lock daemon (<a href="https://redirect.github.com/apache/maven-resolver/pull/2083">#2083</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>fix: deploy-side integrity must fail closed (<a href="https://redirect.github.com/apache/maven-resolver/pull/2084">#2084</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>fix: harden opt-in transport and lock backends against unauthenticated infrastructure (<a href="https://redirect.github.com/apache/maven-resolver/pull/2086">#2086</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>Compose named lock keys one segment per coordinate field (<a href="https://redirect.github.com/apache/maven-resolver/pull/2091">#2091</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>Resolve file transport locations with path operations instead of substring matching (<a href="https://redirect.github.com/apache/maven-resolver/pull/2088">#2088</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>Validate coordinate components in the Maven 2 layout and local path composer (<a href="https://redirect.github.com/apache/maven-resolver/pull/2087">#2087</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
</ul>
<h2>📝 Documentation updates</h2>
<ul>
<li>[docs] Clarify trusted checksum sources (<a href="https://redirect.github.com/apache/maven-resolver/pull/2127">#2127</a>) <a href="https://github.com/jiteshkhatri11"><code>@jiteshkhatri11</code></a></li>
<li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2058">#2058</a>: Add links to configuration page (<a href="https://redirect.github.com/apache/maven-resolver/pull/2060">#2060</a>) <a href="https://github.com/Jamison929611"><code>@Jamison929611</code></a></li>
</ul>
<h2>👻 Maintenance</h2>
<ul>
<li>test: move from minio docker image (<a href="https://redirect.github.com/apache/maven-resolver/pull/2140">#2140</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
<li>Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and test flakiness (<a href="https://redirect.github.com/apache/maven-resolver/issues/1350">#1350</a>) (<a href="https://redirect.github.com/apache/maven-resolver/pull/2108">#2108</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>Fix: tidy up f013 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2104">#2104</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
<li>Fix <a href="https://redirect.github.com/apache/maven-resolver/issues/2096">#2096</a>: harden NamedLocksTrackingFileManagerTest against CI load (<a href="https://redirect.github.com/apache/maven-resolver/pull/2098">#2098</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
<li>Carry repository provenance into aggregateRepositories (<a href="https://redirect.github.com/apache/maven-resolver/pull/2090">#2090</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
<li>Validate the repository key used as a local repository path segment (<a href="https://redirect.github.com/apache/maven-resolver/pull/2089">#2089</a>) <a href="https://github.com/slachiewicz"><code>@slachiewicz</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2136">#2136</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump version.slf4j from 2.0.18 to 2.0.19 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2130">#2130</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2131">#2131</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2129">#2129</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Deps: bump to BC provider 1.85.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2097">#2097</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
<li>Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (<a href="https://redirect.github.com/apache/maven-resolver/pull/2074">#2074</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/apache/maven-resolver/commit/3cc91ea267616918bc6e2a17417edf053f8e92dc"><code>3cc91ea</code></a> [maven-release-plugin] prepare release maven-resolver-2.0.23</li>
<li><a href="https://github.com/apache/maven-resolver/commit/b703cdbb98d57b1a98c39c7721b7c934937b9a69"><code>b703cdb</code></a> Finish the repo key story (<a href="https://redirect.github.com/apache/maven-resolver/issues/2135">#2135</a>)</li>
<li><a href="https://github.com/apache/maven-resolver/commit/a719e8d0113312563b3647877f0dbc5947e4fed6"><code>a719e8d</code></a> test: move from minio docker image (<a href="https://redirect.github.com/apache/maven-resolver/issues/2140">#2140</a>)</li>
<li><a href="https://github.com/apache/maven-resolver/commit/d1d8d940a94c20b04306e6e6214d316e42501948"><code>d1d8d94</code></a> Bump org.apache.maven.plugin-tools:maven-plugin-tools-api (<a href="https://redirect.github.com/apache/maven-resolver/issues/2136">#2136</a>)</li>
<li><a href="https://github.com/apache/maven-resolver/commit/18753daa30739a699ea56e30865e8de7f4e58369"><code>18753da</code></a> fix: accept legacy ID-only tracking entries via backward-compatible fallback ...</li>
<li><a href="https://github.com/apache/maven-resolver/commit/0a74153d40a5982adf2d6a7ee45ac0a6fccff7a3"><code>0a74153</code></a> Fix listener error swallowing (<a href="https://redirect.github.com/apache/maven-resolver/issues/1990">#1990</a>), SyncContext double-close (<a href="https://redirect.github.com/apache/maven-resolver/issues/1992">#1992</a>), and ...</li>
<li><a href="https://github.com/apache/maven-resolver/commit/bd7421fc65fffff6ad3054cae7634441f622df1a"><code>bd7421f</code></a> [docs] Clarify trusted checksum sources (<a href="https://redirect.github.com/apache/maven-resolver/issues/2127">#2127</a>)</li>
<li><a href="https://github.com/apache/maven-resolver/commit/534e16e8fb161a82f36a3a863b526340389c68cb"><code>534e16e</code></a> [MRESOLVER-379] Preserve relocated range candidates (<a href="https://redirect.github.com/apache/maven-resolver/issues/2114">#2114</a>)</li>
<li><a href="https://github.com/apache/maven-resolver/commit/f786540666bc450132bf08dc7832f5d9d768669b"><code>f786540</code></a> Bump version.slf4j from 2.0.18 to 2.0.19 (<a href="https://redirect.github.com/apache/maven-resolver/issues/2130">#2130</a>)</li>
<li><a href="https://github.com/apache/maven-resolver/commit/dec4ec3e908c68fa2ee3b6e41d2c2afcaf998f3d"><code>dec4ec3</code></a> Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (<a href="https://redirect.github.com/apache/maven-resolver/issues/2131">#2131</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/apache/maven-resolver/compare/maven-resolver-1.3.1...maven-resolver-2.0.23">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-spi from 1.3.1 to 2.0.23 (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 closed pull request #20374: build(deps): bump org.apache.maven.resolver:maven-resolver-spi from 1.3.1 to 2.0.23
URL: https://github.com/apache/druid/pull/20374
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-spi from 1.3.1 to 2.0.23 (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on PR #20374:
URL: https://github.com/apache/druid/pull/20374#issuecomment-5724834033
This is an automated dependency triage by Codex GPT-5.6 Luna(Max).
Decision: close this PR as INCOMPATIBLE in isolation. The reserved head was revalidated immediately before this comment as `9eb7ff61fde2588c0aa5bc8a074dfa8ace2fcd74`; the PR was OPEN, non-draft, MERGEABLE/UNSTABLE, with no reviews or prior comments.
## Change and published-release inventory
The only PR diff is `services/pom.xml`, changing `org.apache.maven.resolver:maven-resolver-spi` from `1.3.1` to `2.0.23` (`+1/-1`; no Druid source or test file is changed). The complete Maven Central artifact history reviewed, inclusive of the source and target and excluding project tags that did not publish this GAV, is:
`1.3.1`, `1.3.2`, `1.3.3`, `1.4.0`, `1.4.1`, `1.4.2`, `1.6.1`, `1.6.2`, `1.6.3`, `1.7.0`, `1.7.1`, `1.7.2`, `1.7.3`, `1.8.0`, `1.8.1`, `1.8.2`, `1.9.0`, `1.9.1`, `1.9.2`, `1.9.4`, `1.9.5`, `1.9.6`, `1.9.7`, `1.9.8`, `1.9.10`, `1.9.11`, `1.9.12`, `1.9.13`, `1.9.14`, `1.9.15`, `1.9.16`, `1.9.17`, `1.9.18`, `1.9.19`, `1.9.20`, `1.9.21`, `1.9.22`, `1.9.23`, `1.9.24`, `1.9.25`, `1.9.26`, `1.9.27`, `2.0.0-alpha-1`, `2.0.0-alpha-2`, `2.0.0-alpha-3`, `2.0.0-alpha-5`, `2.0.0-alpha-6`, `2.0.0-alpha-7`, `2.0.0-alpha-8`, `2.0.0-alpha-10`, `2.0.0-alpha-11`, `2.0.0`, `2.0.1`, `2.0.2`, `2.0.3`, `2.0.4`, `2.0.5`, `2.0.6`, `2.0.7`, `2.0.8`, `2.0.9`, `2.0.10`, `2.0.11`, `2.0.13`, `2.0.14`, `2.0.15`, `2.0.16`, `2.0.17`, `2.0.18`, `2.0.20`, `2.0.21`, `2.0.22`, `2.0.23`.
The target is the cumulative 72-artifact-version transition from the 1.3.1 line through the 2.0.x line. The Resolver 2.0.0 release notes document the major removal of `ServiceLocator`, transport cleanup/renames, resolver API changes, and Maven 4/module alignment: https://github.com/apache/maven-resolver/releases/tag/maven-resolver-2.0.0. The target 2.0.23 release adds later repository-key, integrity, path-validation, and coordinate-validation changes: https://github.com/apache/maven-resolver/releases/tag/maven-resolver-2.0.23. The artifact metadata used for the complete inventory is https://repo.maven.apache.org/maven2/org/apache/maven/resolver/maven-resolver-spi/maven-metadata.xml.
## Compatibility analysis
- API/ABI: INCOMPATIBLE. `maven-resolver-spi:1.3.1` contains `org.eclipse.aether.spi.locator.ServiceLocator` and `Service.class`; `2.0.23` removes `org/eclipse/aether/spi/locator` entirely. `maven-resolver-api:2.0.23` also changes `RepositorySystem` (including `Closeable` and new lifecycle/session APIs), while this PR leaves Druid's resolver API/impl/util/connector modules at 1.3.1.
- Runtime: INCOMPATIBLE. The existing Maven 3.6 provider bootstrap calls `MavenRepositorySystemUtils.newServiceLocator()` and Druid then calls `locator.getService(RepositorySystem.class)`. The target 2.0.23 implementation no longer provides the old `DefaultServiceLocator` bootstrap, and the current build fails before runtime.
- Configuration: SAFE in isolation; no Druid configuration keys or defaults change.
- Serialization/wire: SAFE in isolation; no Druid serialized format, protocol, or wire contract changes.
- Persistence: SAFE in isolation; no segment, metadata-store, or persistence format changes.
- Clients: SAFE for Druid public client contracts; no client-facing source changes are present. The dependency resolver runtime is covered by the extension/plugin SPI decision below.
- Transitive dependencies: INCOMPATIBLE. The target SPI POM brings `maven-resolver-api:2.0.23`, while Druid still directly selects resolver API/impl/util/connector/transport 1.3.1 and `maven-resolver-provider:3.6.0`; RequireUpperBoundDeps fails on this mixed graph.
- Licenses: UNRESOLVED/CONCERN. The published target resolver POM is Apache-2.0, but Druid's exact-version license registry still records the resolver entries at 1.3.1 and has no matching java-core Gson entry for the target graph. The license check therefore needs a coordinated registry update; it was not safe to claim completion from this one-line bump.
- Extension/plugin SPI behavior: INCOMPATIBLE. `services/src/main/java/org/apache/druid/cli/PullDependencies.java` imports `DefaultServiceLocator`, `RepositoryConnectorFactory`, `TransporterFactory`, and `HttpTransporterFactory`, and constructs the old locator at lines 204-207. The 2.0.23 stack requires coordinated bootstrap and transport changes; the old HTTP transport artifact has no 2.0.23 release, while Resolver 2.0.23 publishes the renamed `maven-resolver-transport-apache`/`ApacheTransporterFactory` surface.
## Druid impact
Affected call sites are `services/src/main/java/org/apache/druid/cli/PullDependencies.java:35-59,204-207` and the equivalent service bootstrap in `services/src/test/java/org/apache/druid/cli/PullDependenciesTest.java:341-346`. The tracked source/test code is unchanged by the PR, but both call sites are affected by the changed resolver SPI. A safe implementation requires coordinated changes to the resolver API/SPI/util/impl/connector stack, the Maven provider/bootstrap, the HTTP transport artifact and factory, and the exact license registry.
## Validation and CI gate
Local validation confirmed the supplied diff is one version-line change and the worktree has no repair edits. The published 1.3.1/2.0.23 POMs and JAR class lists were compared, including `javap` checks for `ServiceLocator`, `RepositorySystem`, `DefaultServiceLocator`, and the transport factories. All 20 failed job logs and the available static/unit artifacts were inspected: no test-specific failure was found; unit reports contained no additional `<failure>` or `<error>` beyond the compile abort.
At the exact current head `9eb7ff61fde2588c0aa5bc8a074dfa8ace2fcd74`, the complete rollup was 27 completed CheckRuns and 0 StatusContexts: 5 SUCCESS, 20 FAILURE, 1 SKIPPED (`coverage-jacoco`), and 1 NEUTRAL (aggregate `CodeQL`). The 20 failures were deterministic and PR-caused:
- Missing `org.eclipse.aether.spi.locator.ServiceLocator` at `PullDependencies.java:205`: `Analyze (java)` job `105428435862`; `web-checks` `105428437368`; `docker-tests` `105428437447`; all 13 unit jobs `105428437938`, `105428438018`, `105428437878`, `105428437829`, `105428437742`, `105428437801`, `105428437881`, `105428437686`, `105428437808`, `105428437771`, `105428437689`, `105428437744`, `105428437786`.
- RequireUpperBoundDeps conflicts between resolver 1.3.1 and target-induced API 2.0.23: `packaging-check-jdk25` `105428437356`; `static-checks-maven` `105428437307`; `strict-compilation` `105428437186`; `openrewrite` `105428437382`.
Because these failures are deterministic consequences of the incompatible mixed dependency graph, no CI rerun was eligible or useful, and no rerun was attempted. No repair commit or push was made. Approval was not submitted because the compatibility gates are not all SAFE and the exact-head rollup is not green.
## Automation actions
This is a non-duplicate, evidence-backed closure recommendation for the assigned ROUND_1 PR. The bounded action is to close the PR. A future safe change must be a coordinated Maven Resolver 2.x migration with focused source/test/bootstrap/transport/license updates followed by a fresh full CI run. No merge was performed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-spi from 1.3.1 to 2.0.23 (druid)
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] commented on PR #20374:
URL: https://github.com/apache/druid/pull/20374#issuecomment-5724839168
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. You can also ignore all major, minor, or patch releases for a dependency by adding an [`ignore` condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired `update_types` to your config file.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org