This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 3795153b84d fix: license check ignores transitive dependencies in
dependency reports (#20528)
3795153b84d is described below
commit 3795153b84d0946572f4fc1d2ef3cfffe087b04e
Author: Andreas Maechler <[email protected]>
AuthorDate: Tue Oct 20 06:20:41 2026 -0600
fix: license check ignores transitive dependencies in dependency reports
(#20528)
* fix: license check ignores transitive dependencies in dependency reports
The parser path added for the newer project-info-reports format only
matched the direct compile anchor and stalled after the first table, so
check-licenses.py compared 68 instead of ~420 dependencies against
licenses.yaml. Match both compile anchors in any state, fail when a compile
table is left unparsed, map three more license spellings, and fix the
licenses.yaml drift the check now reports.
* Update licenses.yaml for dependency bumps merged since the fix
lz4-java 1.12.0 (#20547), async-http-client 3.0.14 (#20535) and
commons-lang3 3.21.0 (#20548) were bumped on master without matching
licenses.yaml updates, which the fixed check now reports.
* Update licenses.yaml for checker-qual 4.3.0
checker-qual was bumped to 4.3.0 on master (#20611) without a matching
licenses.yaml update, which the fixed check reports.
---
distribution/bin/check-licenses.py | 25 ++++++++++----------
licenses.yaml | 48 +++++++++++++++++++++++++++-----------
2 files changed, 47 insertions(+), 26 deletions(-)
diff --git a/distribution/bin/check-licenses.py
b/distribution/bin/check-licenses.py
index 0eedd005e64..9060a36678e 100755
--- a/distribution/bin/check-licenses.py
+++ b/distribution/bin/check-licenses.py
@@ -50,18 +50,23 @@ class DependencyReportParser(HTMLParser):
def parse(self, f):
self.dep_to_license = {}
+ self.tables_started = 0
+ self.tables_finished = 0
self.feed(f.read())
+ if self.tables_finished < self.tables_started:
+ raise Exception("Parsed only {} of {} compile dependency
tables".format(self.tables_finished, self.tables_started))
return self.dep_to_license
def handle_starttag(self, tag, attrs):
# print("current: {}, start tag: {}, attrs:{} ".format(self.state,
tag, attrs))
+ if tag == "a" and dict(attrs).get("id") in
("Project_Dependencies_compile", "Project_Transitive_Dependencies_compile"):
+ self.state = "h3_end"
+ self.include_classifier = False
+ self.tables_started += 1
+
if self.state == "none":
if tag == "h2":
self.state = "h2_start"
- elif tag == "a":
- for attr in attrs:
- if attr[0] == "id" and attr[1] ==
"Project_Dependencies_compile":
- self.state = "modern_compile_anchor"
if self.state == "h2_start":
if tag == "a":
@@ -80,10 +85,6 @@ class DependencyReportParser(HTMLParser):
if attr[0] == "name" and attr[1] == "compile":
self.state = "compile_start"
- if self.state == "modern_compile_heading":
- if tag == "h2":
- self.state = "h3_end"
-
if self.state == "h3_end":
if tag == "table":
self.state = "table_start"
@@ -118,10 +119,6 @@ class DependencyReportParser(HTMLParser):
if tag == "a":
self.state = "project_dependencies_end"
- if self.state == "modern_compile_anchor":
- if tag == "a":
- self.state = "modern_compile_heading"
-
if self.state == "h2_start":
if tag == "h2":
self.state = "h2_end"
@@ -169,6 +166,7 @@ class DependencyReportParser(HTMLParser):
if self.state == "row_end":
if tag == "table":
self.state = "none"
+ self.tables_finished += 1
def handle_data(self, data):
if self.state == "td_start":
@@ -258,6 +256,7 @@ def build_compatible_license_names():
compatible_licenses['BSD-2-Clause'] = 'BSD-2-Clause License'
compatible_licenses['BSD 2-Clause license'] = 'BSD-2-Clause License'
compatible_licenses['BSD 2-Clause License'] = 'BSD-2-Clause License'
+ compatible_licenses['The BSD 2-Clause License'] = 'BSD-2-Clause License'
compatible_licenses['BSD-3-Clause License'] = 'BSD-3-Clause License'
compatible_licenses['New BSD license'] = 'BSD-3-Clause License'
@@ -326,10 +325,12 @@ def build_compatible_license_names():
compatible_licenses['Bouncy Castle Licence'] = 'MIT License'
compatible_licenses['SPDX-License-Identifier: MIT'] = 'MIT License'
compatible_licenses['MIT'] = 'MIT License'
+ compatible_licenses['MIT license'] = 'MIT License'
compatible_licenses['MIT-0'] = 'MIT No Attribution'
compatible_licenses['The Go license'] = 'The Go license'
+ compatible_licenses['Go License'] = 'The Go license'
compatible_licenses['Universal Permissive License, Version 1.0'] =
'Universal Permissive License, Version 1.0'
compatible_licenses['-'] = '-'
diff --git a/licenses.yaml b/licenses.yaml
index 89450c831b7..defdc07d745 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -820,13 +820,13 @@ name: Apache Commons Lang
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 3.20.0
+version: 3.21.0
libraries:
- org.apache.commons: commons-lang3
notices:
- commons-lang3: |
Apache Commons Lang
- Copyright 2001-2025 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (https://www.apache.org/).
@@ -1872,7 +1872,7 @@ name: jackson-jq
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 1.6.3
+version: 1.6.5
libraries:
- net.thisptr: jackson-jq
@@ -2147,17 +2147,29 @@ name: Apache Maven
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 3.6.0
+version: 3.9.16
libraries:
- org.apache.maven: maven-repository-metadata
- org.apache.maven: maven-builder-support
+ - org.apache.maven: maven-model
+ - org.apache.maven: maven-model-builder
+ - org.apache.maven: maven-resolver-provider
notices:
- maven-repository-metadata: |
Maven Repository Metadata Model
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
- maven-builder-support: |
Maven Builder Support
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
+ - maven-model: |
+ Maven Model
+ Copyright 2001-2026 The Apache Software Foundation
+ - maven-model-builder: |
+ Maven Model Builder
+ Copyright 2001-2026 The Apache Software Foundation
+ - maven-resolver-provider: |
+ Maven Artifact Resolver Provider
+ Copyright 2001-2026 The Apache Software Foundation
---
name: Apache Maven Artifact
@@ -2209,10 +2221,14 @@ license_name: Apache License version 2.0
version: 2.0.24
libraries:
- org.apache.maven.resolver: maven-resolver-transport-apache
+ - org.apache.maven.resolver: maven-resolver-transport-file
notices:
- maven-resolver-transport-apache: |
Maven Artifact Resolver Transport Apache
Copyright 2001-2026 The Apache Software Foundation
+ - maven-resolver-transport-file: |
+ Maven Artifact Resolver Transport File
+ Copyright 2010-2026 The Apache Software Foundation
---
@@ -2223,10 +2239,14 @@ license_name: Apache License version 2.0
version: 2.0.24
libraries:
- org.apache.maven.resolver: maven-resolver-impl
+ - org.apache.maven.resolver: maven-resolver-named-locks
notices:
- maven-resolver-impl: |
Maven Artifact Resolver Implementation
Copyright 2001-2026 The Apache Software Foundation
+ - maven-resolver-named-locks: |
+ Maven Artifact Resolver Named Locks
+ Copyright 2010-2026 The Apache Software Foundation
---
name: Plexus Component Annotations
@@ -2306,7 +2326,7 @@ name: AsyncHttpClient asynchttpclient
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 3.0.13
+version: 3.0.14
libraries:
- org.asynchttpclient: async-http-client
@@ -2343,7 +2363,7 @@ name: Plexus Interpolation API
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 1.25
+version: 1.29
libraries:
- org.codehaus.plexus: plexus-interpolation
@@ -2591,7 +2611,7 @@ name: LZ4 Java
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 1.11.4
+version: 1.12.0
libraries:
- at.yawk.lz4: lz4-java
@@ -3389,7 +3409,7 @@ name: Checker Qual
license_category: binary
module: java-core
license_name: MIT License
-version: 4.2.3
+version: 4.3.0
copyright: the Checker Framework developers
license_file_path: licenses/bin/checker-qual.MIT
libraries:
@@ -3436,7 +3456,7 @@ name: SLF4J API
license_category: binary
module: java-core
license_name: MIT License
-version: 2.0.18
+version: 2.0.20
copyright: QOS.ch
license_file_path: licenses/bin/slf4j.MIT
libraries:
@@ -4294,7 +4314,7 @@ name: google-auto-value
license_category: binary
module: extensions/druid-google-extensions
license_name: Apache License version 2.0
-version: 1.11.0
+version: 1.11.1
libraries:
- com.google.auto.value: auto-value-annotations
@@ -7413,7 +7433,7 @@ libraries:
---
name: Kafka Schema Registry Client
-version: 8.3.1
+version: 8.3.2
license_category: binary
module: extensions/druid-protobuf-extensions
license_name: Apache License version 2.0
@@ -7446,7 +7466,7 @@ libraries:
---
name: Confluent Kafka Client
-version: 8.3.1-ccs
+version: 8.3.2-ccs
license_category: binary
module: extensions/druid-protobuf-extensions
license_name: Apache License version 2.0
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
