FrankChen021 commented on PR #20034: URL: https://github.com/apache/druid/pull/20034#issuecomment-5322927641
## Codex triage: CLOSED_HIGH_EFFORT/WONT_FIX_LARGE_CHANGE The exact head `bdccad86a4c04bcafe4a4a83c274a8a1d8be3722` was rechecked against master `cb26014728ab3239bc8d7391f9cf6466e63905b0`. The PR contains one changed path, `extensions-core/google-extensions/pom.xml`, changing only `com.google.api:gax` from `2.37.0` to `2.83.0`. The target causes a real Maven dependency-convergence failure in `druid-google-extensions`, reproduced by five terminal checks: - [packaging-check](https://github.com/apache/druid/actions/runs/32082293186/job/95547483469) - [static-checks-maven](https://github.com/apache/druid/actions/runs/32082293186/job/95547483444) - [strict-compilation](https://github.com/apache/druid/actions/runs/32082293186/job/95547483294) - [openrewrite](https://github.com/apache/druid/actions/runs/32082293186/job/95547483347) - [validate-dist](https://github.com/apache/druid/actions/runs/32082293336/job/95547483784) All five report the same `RequireUpperBoundDeps` conflict between the new GAX paths and the versions retained by `google-cloud-storage:2.29.1` / `google-cloud-core:2.27.0`: `api-common` 2.66.0 vs 2.20.0, auth 1.50.0 vs 1.20.0, protobuf-util 4.33.6 vs 3.24.4, threetenbp 1.7.0 vs 1.6.8, grpc-api 1.82.2 vs 1.59.0, google-http-client-gson 2.2.0 vs 1.43.3, and auto-value-annotations 1.11.0 vs 1.10.4. The local resolved tree also shows the old GAX 2.37.0 transitively retained by both Google Cloud dependencies, plus target-only `jspecify:1.0.0`. The two other failed checks are unrelated to this one-path PR: [unit K](https://github.com/apache/druid/actions/runs/32082293336/job/95547484021) reports two `KafkaClusterMetricsTest` 60-second event timeouts, and [unit S](https://github.com/apache/druid/actions/runs/32082293336/job/95547483787) reports `processing` `SuperSorterTest` assertions (`expected 1.0 but was 0.0`). The remaining rollup was terminal: 19 successes and two workflow-skipped jobs ([coverage](https://github.com/apache/druid/actions/runs/32082293336/job/95556282115), [docker-tests](https://github.com/apache/druid/actions/runs/32082293336/job/95556282270)); no pending or neutral checks. Compatibility review found no changed Druid configuration, serialization, wire, persistence, stored-data, or extension SPI surface. Druid only consumes `com.google.api.gax.paging.Page` in `GoogleStorage.java` and `GoogleStorageTest.java`; public `javap` output for `Page` is identical in GAX 2.37.0 and 2.83.0. The target remains Java 8 compatible per the upstream GAX documentation. However, upstream explicitly warns that GAX should not be upgraded independently of `google-cloud-java` because of diamond dependencies: https://github.com/googleapis/sdk-platform-java/tree/main/gax-java. A safe change therefore needs a coordinated Google Cloud family migration, broad extension/runtime testing, and license/NOTICE review. Druid's `licenses.yaml` still records GAX as 2.37.0 and records the old transitive versions; that registry feeds binary `LICENSE`/`NOTICE` generation. The published target POM identifies GAX as BSD-3-Clause: https://repo1.maven.org/maven2/com/google/api/gax/2.83.0/gax-2.83.0.pom. GitHub's Maven advisory query and OSV returned no advisory for this exact artifact/version. No exact 2.83.0 release-note entry or tag was available in the archived upstream repository; the published POM and upstream API/versioning documentation were used as the authoritative release evidence. Suppressing Enforcer, excluding the target's dependencies, or locally overriding only the conflicting versions would leave a mixed Google Cloud runtime and would not be a safe surgical fix. The PR is therefore closed as `CLOSED_HIGH_EFFORT/WONT_FIX_LARGE_CHANGE`; no commit or push was made. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
