rangareddy opened a new pull request, #19433:
URL: https://github.com/apache/hudi/pull/19433

   ### Describe the issue this Pull Request addresses
   
   Closes #16407 (HUDI-7455).
   
   Seven bundles set 
`<createDependencyReducedPom>false</createDependencyReducedPom>`, so the POM 
published
   to Maven Central still declares the artifacts that were shaded into the jar. 
Consumers inherit those
   artifacts as transitive dependencies even though the classes are already 
inside the bundle — and are
   relocated there, so the transitive copies are never the ones the bundle 
itself uses.
   
   What suggests this was unintended rather than deliberate: each of those 
bundles *also* sets
   
`<dependencyReducedPomLocation>${project.build.directory}/dependency-reduced-pom.xml</dependencyReducedPomLocation>`
   in the same `<configuration>` block, `dependency-reduced-pom.xml` is already 
in `.gitignore`, and
   `hudi-timeline-server-bundle` already sets the flag to `true` — as do the 
nine bundles that simply don't
   override shade's default.
   
   ### Summary and Changelog
   
   Set `createDependencyReducedPom` to `true` for the seven bundles that had it 
disabled:
   `hudi-aws-bundle`, `hudi-hadoop-mr-bundle`, `hudi-datahub-sync-bundle`, 
`hudi-presto-bundle`,
   `hudi-azure-bundle`, `hudi-hive-sync-bundle`, `hudi-gcp-bundle`. No other 
change; the reduced POM already
   had a configured output location under `target/`.
   
   Measured on `hudi-aws-bundle`, which declares six compile-scope dependencies:
   
   - **before:** no reduced POM is generated at all, so all six are published 
as transitive dependencies.
   - **after:** `hudi-aws`, `hudi-hive-sync`, `httpclient`, `httpcore` are 
dropped (all four are in the
     bundle's `artifactSet`; the httpcomponents classes are relocated to
     `org.apache.hudi.aws.org.apache.httpcomponents`), and `hudi-common` + 
`parquet-avro` are kept, which is
     correct — neither is bundled, so both are genuinely required at runtime.
   
   All seven bundles were built (`mvn package -pl packaging/<bundle> 
-DskipTests`) and each now emits a
   reduced POM; `hudi-hive-sync-bundle` goes to one remaining dependency and 
`hudi-hadoop-mr-bundle` to none.
   `apache-rat:check` passes.
   
   One scope note: the issue's headline example is `parquet-avro` published at 
1.10.1 while bundled at 1.12.2
   in 0.13.1. That specific mismatch no longer exists — `parquet-avro` is not 
bundled any more, as the
   reporter observed for 0.14.1 — so this PR intentionally does not remove it. 
What it fixes is the
   still-present leak of the artifacts that *are* bundled.
   
   `hudi-io/pom.xml` also sets the flag to `false` and is deliberately left 
alone: it is a library rather
   than a shaded bundle, and whether its POM should be reduced is a separate 
question.
   
   ### Impact
   
   This changes the **published POM** of seven artifacts. A downstream build 
that currently resolves, for
   example, `httpclient` transitively through `hudi-aws-bundle` will need to 
declare it directly. That is the
   intended correction — a shaded bundle should not advertise dependencies it 
has already absorbed — but it
   is visible to consumers and worth a release note. Happy to stage it per 
bundle instead of all seven at once
   if you would prefer smaller steps.
   
   No change to the jar contents, to any Hudi API, config, or table format.
   
   ### Risk Level
   
   medium — it alters published dependency metadata for seven released 
artifacts. Verified that all seven
   build, that a reduced POM is produced for each, and (on `hudi-aws-bundle`) 
exactly which dependencies are
   removed versus retained, confirming shade only drops artifacts it actually 
bundled. Relocation-vs-removal
   was audited in detail for `hudi-aws-bundle`; for the other six I verified 
the build and the reduced POM but
   not every individual `<relocation>` entry.
   
   ### Documentation Update
   
   none in the docs tree, but this is worth a line in the release notes for the 
affected bundles, since
   consumers may need to declare dependencies they previously received 
transitively.
   
   ### Contributor's checklist
   
   - [x] Read through [contributor's 
guide](https://hudi.apache.org/contribute/how-to-contribute)
   - [x] Enough context is provided in the sections above
   - [x] Adequate tests were added if applicable
   - [x] CI passes on my PR
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to