[orc] branch main updated: ORC-1420: Pin `net.bytebuddy` package to 1.12.x

[do...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

dongjoon pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/orc.git


The following commit(s) were added to refs/heads/main by this push:
     new e569dcbaa ORC-1420: Pin `net.bytebuddy` package to 1.12.x
e569dcbaa is described below

commit e569dcbaae22f6ea29c068385d7ae4c5906f785f
Author: Dongjoon Hyun <do...@apache.org>
AuthorDate: Sat May 6 18:54:44 2023 -0700

    ORC-1420: Pin `net.bytebuddy` package to 1.12.x
    
    ### What changes were proposed in this pull request?
    
    This PR aims to pin `net.bytebuddy` package to 1.12.x.
    
    ### Why are the changes needed?
    
    `byte-buddy` is a transitive dependency from `Mockito` and currently we have inconsistency among byte-buddy libraries like the following.
    
    ```
    $ mvn dependency:tree | grep byte
    [INFO] |  +- net.bytebuddy:byte-buddy:jar:1.12.23:test
    [INFO] |  +- net.bytebuddy:byte-buddy-agent:jar:1.12.19:test
    ```
    
    Since ORC-1360 pinned `Mockito` at 4.x, we had better pin them 1.12.x with the same latest version, `1.12.23`.
    
    ### How was this patch tested?
    
    Pass the CIs.
    
    Closes #1461
    
    Closes #1487 from dongjoon-hyun/ORC-1420.
    
    Authored-by: Dongjoon Hyun <do...@apache.org>
    Signed-off-by: Dongjoon Hyun <do...@apache.org>
---
 .github/dependabot.yml | 3 +++
 java/pom.xml           | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bf827b6fb..f31ef94ed 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -51,6 +51,9 @@ updates:
       # Pin mockito to 4.x
       - dependency-name: "org.mockito"
         versions: "[5.0.0,)"
+      # Pin byte-buddy to 1.12.x aline with mockito
+      - dependency-name: "net.bytebuddy"
+        versions: "[1.13.0,)"
       # Pin spotless to 2.30.0 due to Java 8 support
       - dependency-name: "com.diffplug.spotless:spotless-maven-plugin"
         versions: "[2.31.0,)"
diff --git a/java/pom.xml b/java/pom.xml
index 94cf30e07..a3ca5c279 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -441,6 +441,12 @@
         <version>1.12.23</version>
         <scope>test</scope>
       </dependency>
+      <dependency>
+        <groupId>net.bytebuddy</groupId>
+        <artifactId>byte-buddy-agent</artifactId>
+        <version>1.12.23</version>
+        <scope>test</scope>
+      </dependency>
       <dependency>
         <groupId>com.google.auto.service</groupId>
         <artifactId>auto-service</artifactId>