FrankChen021 commented on PR #19754: URL: https://github.com/apache/druid/pull/19754#issuecomment-5132844820
@sklochkov2 I took a closer look at the dependency-related failures. There is a distinction worth calling out: this PR upgrades Druid's legacy HTTP client from Netty 3.10.6 to Netty 4.1.136, but it also changes the existing global `netty4.version` from 4.2.15 to 4.1.136. The resolved graph is not fully converged on 4.1. `org.asynchttpclient:async-http-client:3.0.11` still brings in the 4.2-only modules `io.netty:netty-codec-base:4.2.15.Final` and `io.netty:netty-codec-compression:4.2.15.Final`, while the rest of the Netty jars resolve to 4.1.136. The PR removes those two 4.2 artifacts from `licenses.yaml`, which is why both `validate-dist` and `static-checks-maven` report missing licenses. More importantly, the resulting runtime/test classpath mixes Netty 4.1 and 4.2 jars. I suggest fixing the dependency graph rather than only restoring the two license entries: 1. Choose one coherent Netty line for the complete graph: either migrate all consumers to 4.2, or pin/use versions of async-http-client and other Netty consumers that are genuinely compatible with 4.1. 2. Avoid the broad `requireUpperBoundDeps` exclusions for every `io.netty` artifact. Those exclusions currently hide the mixed-version graph that the check should catch. 3. Re-run the dependency tree/convergence checks and `.github/scripts/license_checks_script.sh` after the graph is coherent, then update `licenses.yaml` to match the artifacts that actually resolve. 4. Please do not treat a rerun as sufficient for these two checks: the missing-license result is deterministic on the current commit. Separately, the packaging lock and QTest timeout look like Maven/repository contention, and the Kafka failure is a test-producer partition-expansion race; those are different issues from the dependency mismatch. Disclosure: this comment was generated by GPT-5.6-Sol after inspecting the PR patch, resolved test classpath, and GitHub Actions logs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
