[I] [Bug] Bundled NOTICE of paimon-oss-impl lists stale dependency versions after the aliyun-sdk-oss 3.17.4 bump [paimon]

["thswlsqls (via GitHub)" <gi...@apache.org>]

thswlsqls opened a new issue, #8966:
URL: https://github.com/apache/paimon/issues/8966

   **Search before asking**
   - [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar.
   
   **Paimon version**
   master @ b85955cb7 (2.1-SNAPSHOT)
   
   **Compute Engine**
   Engine-agnostic (packaging / `paimon-filesystems/paimon-oss-impl`)
   
   **Minimal reproduce step**
   ```bash
   mvn -pl paimon-filesystems/paimon-oss-impl -DskipTests package
   unzip -p paimon-filesystems/paimon-oss-impl/target/paimon-oss-impl-*.jar META-INF/NOTICE
   ```
   The shade log prints `Including com.aliyun.oss:aliyun-sdk-oss:jar:3.17.4`, but the bundled `META-INF/NOTICE` still says `3.13.2`.
   
   **What doesn't meet your expectations?**
   The bundled NOTICE must list the versions actually shaded into the jar. Six entries are stale: `aliyun-sdk-oss` (3.13.2), `commons-codec` (1.9), `httpclient` (4.4.1), `httpcore` (4.4.1), `jettison` (1.1) and `jdom2` (2.0.6).
   
   **Anything else?**
   Introduced by #8832 (e039421b2), which raised `fs.oss.sdk.version` from 3.13.2 to 3.17.4 without updating the NOTICE — the stale entries match `aliyun-sdk-oss:3.13.2`'s dependency set exactly. `paimon-oss` shades `META-INF/**` from this module, so the file ships in the released `paimon-oss` jar. Same fix shape as #7383 and #6781.
   
   **Are you willing to submit a PR?**
   - [x] I'm willing to submit a PR!
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Bundled NOTICE of paimon-oss-impl lists stale dependency versions after the aliyun-sdk-oss 3.17.4 bump [paimon]

["JingsongLi (via GitHub)" <gi...@apache.org>]

JingsongLi closed issue #8966: [Bug] Bundled NOTICE of paimon-oss-impl lists stale dependency versions after the aliyun-sdk-oss 3.17.4 bump
URL: https://github.com/apache/paimon/issues/8966


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org