amaechler opened a new pull request, #20737: URL: https://github.com/apache/druid/pull/20737
Part of #20732. ### Description Several `licenses.yaml` entries list a version their module no longer ships, so the binary LICENSE shows the wrong version for those jars. `check-licenses.py` does not catch this because it matches (groupId, artifactId, version) across all modules: if any module registers the shipped version, the stale entry passes. I found these with the refresh script from #20736, which matches each entry against its own module's dependency report. I then checked every change against the jars in a locally built binary distribution (`-Pdist`), including the shaded jar of `druid-protobuf-extensions`. #### Version updates | Module | Library | Was | Ships | | --- | --- | --- | --- | | `druid-kubernetes-extensions` | `commons-collections4` | 4.4 | 4.6.0 | | `druid-kubernetes-extensions` | `gson` | 2.8.6 | 2.14.0 | | `druid-avro-extensions` | `gson` | 2.3.1 | 2.14.0 | | `druid-protobuf-extensions` | `gson` (shaded) | 2.8.9 | 2.14.0 | | `druid-hdfs-storage` | `hadoop-client-api` | 3.3.6 | 3.5.0 | | `java-core` | `protobuf-java` | 4.36.0 | 4.36.2 | #### Entries restructured - **`eventstream`:** `lib/` ships `eventstream-1.0.1.jar`, but the "AWS SDK for Java 2" entry listed it at the SDK version (2.55.6). It now has its own `java-core` entry at 1.0.1, like the existing one for `druid-s3-extensions`. - **Avro in `druid-avro-extensions`:** the extension ships `avro-1.12.2.jar` only. The entry was at 1.11.5 and also listed `avro-mapred`, `avro-ipc` and `avro-ipc-jetty`, which are not bundled, so those libraries and their notices are removed. - **Kafka in `druid-avro-extensions`:** there were two `kafka-clients` entries (6.2.12-ccs and 5.5.1-ccs), and the extension ships 8.3.2-ccs. One entry is updated and the other removed. #### Checks - `check-licenses.py` passes, and its "unchecked" warnings drop from 158 to 145. - The refresh script reports nothing left to update. - `generate-binary-license.py` and `generate-binary-notice.py` run cleanly. The generated files show the new versions, and the NOTICE no longer carries the `avro-mapred` notice. Not in this PR: 24 older entries whose libraries now ship only at versions other entries register, for example a second `swagger-annotations` entry at 1.6.11 in `druid-kubernetes-extensions`, or Guava 32.1.3-jre next to the current Guava entry in `java-core`. `check-licenses.py` reports these as unchecked; removing them is a separate cleanup. <hr> This PR has: - [x] been self-reviewed. - [x] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
