FrankChen021 commented on PR #19930: URL: https://github.com/apache/druid/pull/19930#issuecomment-5224409456
I verified this PR at head `0a917b9fcfc2e4b28560c4ae86bf16fb3c48de29` against `master` `8855072aab605c68a4705f7d69875673bfbf81d4`. The only changed path is `services/pom.xml`, changing `org.apache.maven.resolver:maven-resolver-impl` from `1.3.1` to `2.0.21`. This head is not approvable. The exact-head [unit-test logs](https://github.com/apache/druid/actions/runs/31228504169/job/93027439751), [strict-compilation logs](https://github.com/apache/druid/actions/runs/31228504033/job/93027439116), [packaging logs](https://github.com/apache/druid/actions/runs/31228504033/job/93027439251), [web-check logs](https://github.com/apache/druid/actions/runs/31228504033/job/93027439187), and all three CodeQL language jobs fail compiling `PullDependencies.java` because `org.eclipse.aether.impl.DefaultServiceLocator` is missing. I independently reproduced the same two-symbol compile failure with JDK 25 in the assigned worktree. The effective dependency tree also fails Maven Enforcer: `maven-resolver-impl:2.0.21` requests API/SPI/Util `2.0.21`, while Druid directly pins those modules, the connector, and HTTP transport to `1.3.1`; `maven-resolver-provider:3.6.0` also brings Resolver `1.3.1`. The Resolver project documents that clients must align API, SPI, Util, impl, connectors, and transports to one version ([compatibility contract](https://maven.apache.org/resolver/api-compatibility.html)), and its 1.x-to-2.x guide requires session-lifecycle migration ([upgrade guide](https://maven.apache.org/resolver/upgrading-resolver.html)). The 2.0.21 artifact does not contain `DefaultServiceLocator`, and the current 2.x transport family is different from Druid's `maven-resolver-transport-http` declaration ([2.0.21 dependency inventory](https://maven.apache.org/resolver/maven-resolver-tools/dependencies.html)). Fixing this is therefore not a safe one-line version bump: it requires a coordinated Resolver-family/provider/transport migration, production and test source changes around `DefaultServiceLocator` and session handling, server dependency alignment, license metadata updates, and focused regression coverage for `pull-deps`. The branch is also reported as not maintainer-writable (`maintainerCanModify=false`), so I cannot apply a surgical fix here. Closing this PR as `CLOSED_HIGH_EFFORT`; please reopen with a coordinated migration PR if the 2.x upgrade is still desired. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
