You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@druid.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/08/07 23:53:14 UTC

[PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.21 (druid)

dependabot[bot] opened a new pull request, #19930:
URL: https://github.com/apache/druid/pull/19930

   Bumps [org.apache.maven.resolver:maven-resolver-impl](https://github.com/apache/maven-resolver) from 1.3.1 to 2.0.21.
   <details>
   <summary>Release notes</summary>
   <p><em>Sourced from <a href="https://github.com/apache/maven-resolver/releases">org.apache.maven.resolver:maven-resolver-impl's releases</a>.</em></p>
   <blockquote>
   <h2>2.0.21</h2>
   <!-- raw HTML omitted -->
   <h2>🚀 New features and improvements</h2>
   <ul>
   <li>RRF: self-heal from provably broken auto-discovered prefixes files (<a href="https://redirect.github.com/apache/maven-resolver/pull/1976">#1976</a>) <a href="https://github.com/ascheman"><code>@ascheman</code></a></li>
   <li>Feat: config to close connection at end of tx (<a href="https://redirect.github.com/apache/maven-resolver/pull/1978">#1978</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Feat: new (limited) transport (<a href="https://redirect.github.com/apache/maven-resolver/pull/1966">#1966</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Expose additional transport details to TransportListener (<a href="https://redirect.github.com/apache/maven-resolver/pull/1762">#1762</a>) <a href="https://github.com/kwin"><code>@kwin</code></a></li>
   <li>Support HTTP/3 in Jetty and JRE HTTP Client (<a href="https://redirect.github.com/apache/maven-resolver/pull/1949">#1949</a>) <a href="https://github.com/kwin"><code>@kwin</code></a></li>
   <li>Skip validation and decoration on re-entrant RepositorySystem calls (<a href="https://redirect.github.com/apache/maven-resolver/pull/1957">#1957</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   </ul>
   <h2>🐛 Bug Fixes</h2>
   <ul>
   <li>Fix: preserve original trace data when stamping re-entrancy marker (<a href="https://redirect.github.com/apache/maven-resolver/pull/1980">#1980</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Bug: in certain cases Resolver caused build failure (<a href="https://redirect.github.com/apache/maven-resolver/pull/1975">#1975</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Make sure to always close input streams bound to responses (<a href="https://redirect.github.com/apache/maven-resolver/pull/1970">#1970</a>) <a href="https://github.com/kwin"><code>@kwin</code></a></li>
   <li>Fix: be more defensive regarding request traces (<a href="https://redirect.github.com/apache/maven-resolver/pull/1973">#1973</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix reporting of HTTP/3 in JdkTransporter (<a href="https://redirect.github.com/apache/maven-resolver/pull/1967">#1967</a>) <a href="https://github.com/kwin"><code>@kwin</code></a></li>
   <li>Validate path components (<a href="https://redirect.github.com/apache/maven-resolver/pull/1959">#1959</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Bug: Apache transport deadlock in concurrent use case (<a href="https://redirect.github.com/apache/maven-resolver/pull/1953">#1953</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Fix potential NPEs in IpcClient and resource leak in DependencyGraphParser (<a href="https://redirect.github.com/apache/maven-resolver/pull/1945">#1945</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Bug: Jetty transport used wrong config (<a href="https://redirect.github.com/apache/maven-resolver/pull/1948">#1948</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   </ul>
   <h2>📝 Documentation updates</h2>
   <ul>
   <li>fix: Some since javadoc tags were off; fixed (<a href="https://redirect.github.com/apache/maven-resolver/pull/1968">#1968</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (<a href="https://redirect.github.com/apache/maven-resolver/pull/1950">#1950</a>) <a href="https://github.com/potiuk"><code>@potiuk</code></a></li>
   </ul>
   <h2>👻 Maintenance</h2>
   <ul>
   <li>Use try-with-resources in AbstractTransporter (<a href="https://redirect.github.com/apache/maven-resolver/pull/1947">#1947</a>) <a href="https://github.com/Aayush10016"><code>@Aayush10016</code></a></li>
   <li>Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (<a href="https://redirect.github.com/apache/maven-resolver/pull/1950">#1950</a>) <a href="https://github.com/potiuk"><code>@potiuk</code></a></li>
   <li>Fix potential NPEs in IpcClient and resource leak in DependencyGraphParser (<a href="https://redirect.github.com/apache/maven-resolver/pull/1945">#1945</a>) <a href="https://github.com/gnodet"><code>@gnodet</code></a></li>
   <li>Limit internal retries to 1 with Java 26+ (<a href="https://redirect.github.com/apache/maven-resolver/pull/1946">#1946</a>) <a href="https://github.com/kwin"><code>@kwin</code></a></li>
   </ul>
   <h2>🔧 Build</h2>
   <ul>
   <li>Use custom doclet to extract configuration metadata with the help of (<a href="https://redirect.github.com/apache/maven-resolver/pull/1965">#1965</a>) <a href="https://github.com/kwin"><code>@kwin</code></a></li>
   </ul>
   <h2>📦 Dependency updates</h2>
   <ul>
   <li>Bump Jetty to 12.1.11 (<a href="https://redirect.github.com/apache/maven-resolver/pull/1969">#1969</a>) <a href="https://github.com/cstamas"><code>@cstamas</code></a></li>
   <li>Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-resolver/pull/1963">#1963</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-resolver/pull/1961">#1961</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-resolver/pull/1960">#1960</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-resolver/pull/1962">#1962</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   <li>Bump bouncycastleVersion from 1.84 to 1.85 (<a href="https://redirect.github.com/apache/maven-resolver/pull/1956">#1956</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
   </ul>
   <h2>2.0.20</h2>
   <!-- raw HTML omitted -->
   </blockquote>
   <p>... (truncated)</p>
   </details>
   <details>
   <summary>Commits</summary>
   <ul>
   <li><a href="https://github.com/apache/maven-resolver/commit/838477a48a6cbcc26a51c56fff7f964440f2aaa3"><code>838477a</code></a> [maven-release-plugin] prepare release maven-resolver-2.0.21</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/f59888098759883ce95d673b883e29fd09b07a9b"><code>f598880</code></a> Add ATR meta (<a href="https://redirect.github.com/apache/maven-resolver/issues/1982">#1982</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/1e5d22aeeadebe2942fb011f2c47ba84d5eced12"><code>1e5d22a</code></a> Fix: preserve original trace data when stamping re-entrancy marker (<a href="https://redirect.github.com/apache/maven-resolver/issues/1980">#1980</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/f4d1fa9cb1f036b9128d9617e80e4e6cf0098cc2"><code>f4d1fa9</code></a> RRF: self-heal from provably broken auto-discovered prefixes files (<a href="https://redirect.github.com/apache/maven-resolver/issues/1976">#1976</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/853288956a17c87538cd2ff11e60bea1ce82e318"><code>8532889</code></a> Bug: in certain cases Resolver caused build failure (<a href="https://redirect.github.com/apache/maven-resolver/issues/1975">#1975</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/0feb2143e382e9095928f14c465a04f52ed99fd8"><code>0feb214</code></a> Feat: config to close connection at end of tx (<a href="https://redirect.github.com/apache/maven-resolver/issues/1978">#1978</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/f97423550e975bd555833926b6fec60712463e56"><code>f974235</code></a> Do not check UrlTransporter for open connections after close</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/dbaf30986168a4c66700193fba7b80b651a84445"><code>dbaf309</code></a> Make sure to always close input streams bound to responses (<a href="https://redirect.github.com/apache/maven-resolver/issues/1970">#1970</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/45482a82ce0377d0c7a0d8fc343eeff6b94012ad"><code>45482a8</code></a> Fix: be more defensive regarding request traces (<a href="https://redirect.github.com/apache/maven-resolver/issues/1973">#1973</a>)</li>
   <li><a href="https://github.com/apache/maven-resolver/commit/4bb69adc2e1a4d38db665c0e8e87ca70e8372f7c"><code>4bb69ad</code></a> Fix tools classpath</li>
   <li>Additional commits viewable in <a href="https://github.com/apache/maven-resolver/compare/maven-resolver-1.3.1...maven-resolver-2.0.21">compare view</a></li>
   </ul>
   </details>
   <br />
   
   
   [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache.maven.resolver:maven-resolver-impl&package-manager=maven&previous-version=1.3.1&new-version=2.0.21)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
   
   Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
   
   [//]: # (dependabot-automerge-start)
   [//]: # (dependabot-automerge-end)
   
   ---
   
   <details>
   <summary>Dependabot commands and options</summary>
   <br />
   
   You can trigger Dependabot actions by commenting on this PR:
   - `@dependabot rebase` will rebase this PR
   - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
   - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
   - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
   - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
   
   
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.21 (druid)

Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.

dependabot[bot] commented on PR #19930:
URL: https://github.com/apache/druid/pull/19930#issuecomment-5224411110

   OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. You can also ignore all major, minor, or patch releases for a dependency by adding an [`ignore` condition](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#ignore) with the desired `update_types` to your config file.
   
   If you change your mind, just re-open this PR and I'll resolve any conflicts on it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.21 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 commented on PR #19930:
URL: https://github.com/apache/druid/pull/19930#issuecomment-5224409456

   I verified this PR at head `0a917b9fcfc2e4b28560c4ae86bf16fb3c48de29` against `master` `8855072aab605c68a4705f7d69875673bfbf81d4`. The only changed path is `services/pom.xml`, changing `org.apache.maven.resolver:maven-resolver-impl` from `1.3.1` to `2.0.21`.
   
   This head is not approvable. The exact-head [unit-test logs](https://github.com/apache/druid/actions/runs/31228504169/job/93027439751), [strict-compilation logs](https://github.com/apache/druid/actions/runs/31228504033/job/93027439116), [packaging logs](https://github.com/apache/druid/actions/runs/31228504033/job/93027439251), [web-check logs](https://github.com/apache/druid/actions/runs/31228504033/job/93027439187), and all three CodeQL language jobs fail compiling `PullDependencies.java` because `org.eclipse.aether.impl.DefaultServiceLocator` is missing. I independently reproduced the same two-symbol compile failure with JDK 25 in the assigned worktree.
   
   The effective dependency tree also fails Maven Enforcer: `maven-resolver-impl:2.0.21` requests API/SPI/Util `2.0.21`, while Druid directly pins those modules, the connector, and HTTP transport to `1.3.1`; `maven-resolver-provider:3.6.0` also brings Resolver `1.3.1`. The Resolver project documents that clients must align API, SPI, Util, impl, connectors, and transports to one version ([compatibility contract](https://maven.apache.org/resolver/api-compatibility.html)), and its 1.x-to-2.x guide requires session-lifecycle migration ([upgrade guide](https://maven.apache.org/resolver/upgrading-resolver.html)). The 2.0.21 artifact does not contain `DefaultServiceLocator`, and the current 2.x transport family is different from Druid's `maven-resolver-transport-http` declaration ([2.0.21 dependency inventory](https://maven.apache.org/resolver/maven-resolver-tools/dependencies.html)).
   
   Fixing this is therefore not a safe one-line version bump: it requires a coordinated Resolver-family/provider/transport migration, production and test source changes around `DefaultServiceLocator` and session handling, server dependency alignment, license metadata updates, and focused regression coverage for `pull-deps`. The branch is also reported as not maintainer-writable (`maintainerCanModify=false`), so I cannot apply a surgical fix here. Closing this PR as `CLOSED_HIGH_EFFORT`; please reopen with a coordinated migration PR if the 2.x upgrade is still desired.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.21 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 commented on PR #19930:
URL: https://github.com/apache/druid/pull/19930#issuecomment-5224410877

   Closed after the verified high-effort compatibility and build review documented in the preceding comment.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org

Re: [PR] build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.21 (druid)

Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.

FrankChen021 closed pull request #19930: build(deps): bump org.apache.maven.resolver:maven-resolver-impl from 1.3.1 to 2.0.21
URL: https://github.com/apache/druid/pull/19930


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org