ashwintumma23 opened a new pull request, #20329:
URL: https://github.com/apache/druid/pull/20329
## Summary
Removes two unused third-party dependencies
(`com.google.j2objc:j2objc-annotations`
and `org.apache.curator:curator-test`) from modules where static analysis
confirmed
zero source usage, reducing attack surface and license exposure.
## Release note
Removed unused `com.google.j2objc:j2objc-annotations` from root
`dependencyManagement`
and `org.apache.curator:curator-test` from 4 modules (`embedded-tests`,
`rabbit-stream-indexing-service`, `druid-catalog`, `lookups-cached-global`)
where
no source usage was found.
---
### Key changed/added classes in this PR
* `pom.xml`
* `embedded-tests/pom.xml`
* `extensions-contrib/rabbit-stream-indexing-service/pom.xml`
* `extensions-core/druid-catalog/pom.xml`
* `extensions-core/lookups-cached-global/pom.xml`
* `licenses.yaml`
---
## Reason for change
Keeping unused third-party dependencies increases attack surface and license
exposure
without benefit. Static analysis flagged both artifacts as unused, and manual
investigation confirmed zero source imports in the affected modules.
`curator-test` remains declared in the 4 modules that actively use it
(`server`,
`indexing-service`, `kafka-indexing-service`, `kafka-extraction-namespace`)
and in
root `dependencyManagement` for version pinning.
`j2objc-annotations` is already managed by the Guava BOM (already imported),
so the
explicit `dependencyManagement` pin was a redundant no-op.
## Changes
**1. pom.xml (1 entry removed)**
* Removed `com.google.j2objc:j2objc-annotations` version `3.1` from
`dependencyManagement` — redundant, as the Guava BOM already pins this
artifact
at the same version.
**2. embedded-tests/pom.xml (1 entry removed)**
* Removed unused `org.apache.curator:curator-test` test-scope dependency —
zero
`curator.test` / `TestingServer` / `TestingCluster` imports in source.
**3. extensions-contrib/rabbit-stream-indexing-service/pom.xml (1 entry
removed)**
* Removed unused `org.apache.curator:curator-test` test-scope dependency —
zero
`curator.test` imports in source.
**4. extensions-core/druid-catalog/pom.xml (1 entry removed)**
* Removed unused `org.apache.curator:curator-test` test-scope dependency —
zero
`curator.test` imports in source.
**5. extensions-core/lookups-cached-global/pom.xml (1 entry removed)**
* Removed unused `org.apache.curator:curator-test` test-scope dependency
(including
its stale `javassist` exclusion) — zero `curator.test` imports in source.
**6. licenses.yaml (2 sections removed)**
* Removed `j2objc` entry for `core` module.
* Removed `j2objc` entry for `extensions/protobuf-extensions` module.
## Tests
* Verified zero `com.google.j2objc` and `curator.test` imports in all
affected
module source trees
* `curator-test` remains declared and available in the modules that actively
use it
* No compile-time or runtime references to removed artifacts exist in the
affected modules
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
