FrankChen021 commented on PR #19988: URL: https://github.com/apache/druid/pull/19988#issuecomment-5300301152
Disposition: CLOSED_HIGH_EFFORT/WONT_FIX_LARGE_CHANGE PR #19988: https://github.com/apache/druid/pull/19988 Verified head: f7eb8381917ea56115fc5689eab44f8aa2ba84a0 Evidence: - The exact three-dot diff against live master 76e67232663086cbfc5ebeb2cbd73aa9c1cb5048 (the supplied 1350da... snapshot produces the same diff) is one line in pom.xml: hibernate-validator.version 6.2.5.Final -> 9.1.3.Final. - Druid manages jakarta.validation-api 2.0.2 while its source uses javax.validation.* in 137 Java files across processing, server, indexing-service, services, SQL, and extensions. ConfigModule binds javax.validation.Validator and bootstraps Validation.buildDefaultValidatorFactory(). - Hibernate Validator 9.1.3.Final requires jakarta.validation-api 3.1.1 / Jakarta Validation 3.1. The exact-head static-checks, OpenRewrite, strict-compilation, packaging, and validate-dist logs all fail RequireUpperBoundDeps on the managed 2.0.2 versus required 3.1.1 graph. web-checks fails distribution startup because no compatible Bean Validation provider can be discovered. - The QTest shards and JDK 25 shards reproduce the same provider/bootstrap failure (for example, no Jakarta Bean Validation provider, Guice injector creation failure, CalciteTests initialization failures), not independent assertions. The aggregate unit-test log stream returned a transient GitHub stream error; per-job logs were read instead. No jobs were rerun. - Upstream compatibility evidence says HV 6.2 keeps javax.* and Bean Validation 2.0, while HV 9.1 uses Jakarta Validation 3.1. A safe upgrade therefore requires a coordinated source, API, test, extension/plugin, runtime bootstrap, and dependency migration; an exclusion or one-line version adjustment would leave Druid unable to compile or start. No wire, persistence, or stored-data format change is indicated, but public configuration validation and extension compile/runtime contracts are affected. - Both exact-version OSV queries returned no advisory entries; the blocker is compatibility, not a demonstrated security emergency. The upstream artifact is Apache-2.0. No files were changed, no fix/rebase/push was made, and no checks were rerun. Closing this PR because the requested major upgrade is not safely remediable within a dependency-only change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
