This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/storm.git
commit 2acaf50e18391f4e535272b3ae4826bb09a11e45 Author: Richard Zowalla <[email protected]> AuthorDate: Tue Sep 1 07:39:45 2026 +0200 Pin org.jspecify:jspecify so the daemon and worker classpaths agree Guava 33.7.1-jre moves its jspecify transitive from 1.0.0 to 1.0.1. JUnit 6 also declares org.jspecify:jspecify, at a nearer depth than Guava, so the two classpaths of the binary distribution mediated to different versions: lib (daemon) kept jspecify 1.0.0 while lib-common (worker) resolved 1.0.1, and dedup-libs refused to assemble a distribution with shadowed jars. Manage jspecify centrally so every module resolves the same version regardless of which path it arrives on, and keep the property next to guava.version so the two stay coupled. Refresh the guava and jspecify entries in LICENSE-binary and DEPENDENCY-LICENSES to match. --- DEPENDENCY-LICENSES | 4 ++-- LICENSE-binary | 4 ++-- pom.xml | 16 ++++++++++++++++ 3 files changed, 20 insertions(+), 4 deletions(-) diff --git a/DEPENDENCY-LICENSES b/DEPENDENCY-LICENSES index b0db6120d..2490c020b 100644 --- a/DEPENDENCY-LICENSES +++ b/DEPENDENCY-LICENSES @@ -116,7 +116,7 @@ List of third-party dependencies grouped by their license type. * FindBugs-jsr305 (com.google.code.findbugs:jsr305:3.0.2 - http://findbugs.sourceforge.net/) * Graphite Integration for Metrics (io.dropwizard.metrics:metrics-graphite:4.2.39 - https://metrics.dropwizard.io/metrics-graphite) * Gson (com.google.code.gson:gson:2.14.0 - https://github.com/google/gson) - * Guava: Google Core Libraries for Java (com.google.guava:guava:33.6.0-jre - https://github.com/google/guava) + * Guava: Google Core Libraries for Java (com.google.guava:guava:33.7.1-jre - https://github.com/google/guava) * Guava InternalFutureFailureAccess and InternalFutures (com.google.guava:failureaccess:1.0.3 - https://github.com/google/guava/failureaccess) * Guava ListenableFuture only (com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava - https://github.com/google/guava/listenablefuture) * hawtbuf (org.fusesource.hawtbuf:hawtbuf:1.11 - http://hawtbuf.fusesource.org/hawtbuf) @@ -146,7 +146,7 @@ List of third-party dependencies grouped by their license type. * JCL 1.2 implemented over SLF4J (org.slf4j:jcl-over-slf4j:2.0.18 - http://www.slf4j.org) * JHeaps (org.jheaps:jheaps:0.14 - http://www.jheaps.org) * JSON Small and Fast Parser (net.minidev:json-smart:2.6.0 - https://urielch.github.io/) - * JSpecify annotations (org.jspecify:jspecify:1.0.0 - http://jspecify.org/) + * JSpecify annotations (org.jspecify:jspecify:1.0.1 - http://jspecify.org/) * JVM Integration for Metrics (io.dropwizard.metrics:metrics-jvm:4.2.39 - https://metrics.dropwizard.io/metrics-jvm) * Kerby ASN1 Project (org.apache.kerby:kerby-asn1:2.0.3 - https://directory.apache.org/kerby/kerby-common/kerby-asn1) * Kerby Config (org.apache.kerby:kerby-config:2.0.3 - https://directory.apache.org/kerby/kerby-common/kerby-config) diff --git a/LICENSE-binary b/LICENSE-binary index 05cec1041..ad291dcf7 100644 --- a/LICENSE-binary +++ b/LICENSE-binary @@ -688,7 +688,7 @@ The license texts of these dependencies can be found in the licenses directory. * FindBugs-jsr305 (com.google.code.findbugs:jsr305:3.0.2 - http://findbugs.sourceforge.net/) * Graphite Integration for Metrics (io.dropwizard.metrics:metrics-graphite:4.2.39 - https://metrics.dropwizard.io/metrics-graphite) * Gson (com.google.code.gson:gson:2.14.0 - https://github.com/google/gson) - * Guava: Google Core Libraries for Java (com.google.guava:guava:33.6.0-jre - https://github.com/google/guava) + * Guava: Google Core Libraries for Java (com.google.guava:guava:33.7.1-jre - https://github.com/google/guava) * Guava InternalFutureFailureAccess and InternalFutures (com.google.guava:failureaccess:1.0.3 - https://github.com/google/guava/failureaccess) * Guava ListenableFuture only (com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava - https://github.com/google/guava/listenablefuture) * Hibernate Validator Engine (org.hibernate.validator:hibernate-validator:8.0.3.Final - https://hibernate.org/validator) @@ -714,7 +714,7 @@ The license texts of these dependencies can be found in the licenses directory. * JBoss Logging 3 (org.jboss.logging:jboss-logging:3.6.1.Final - http://www.jboss.org) * JCL 1.2 implemented over SLF4J (org.slf4j:jcl-over-slf4j:2.0.18 - http://www.slf4j.org) * JSON Small and Fast Parser (net.minidev:json-smart:2.6.0 - https://urielch.github.io/) - * JSpecify annotations (org.jspecify:jspecify:1.0.0 - http://jspecify.org/) + * JSpecify annotations (org.jspecify:jspecify:1.0.1 - http://jspecify.org/) * JVM Integration for Metrics (io.dropwizard.metrics:metrics-jvm:4.2.39 - https://metrics.dropwizard.io/metrics-jvm) * Kerby ASN1 Project (org.apache.kerby:kerby-asn1:2.0.3 - https://directory.apache.org/kerby/kerby-common/kerby-asn1) * Kerby Config (org.apache.kerby:kerby-config:2.0.3 - https://directory.apache.org/kerby/kerby-common/kerby-config) diff --git a/pom.xml b/pom.xml index 338bf6698..2e07f8bef 100644 --- a/pom.xml +++ b/pom.xml @@ -99,6 +99,13 @@ <jctools.version>4.0.7</jctools.version> <jgrapht.version>1.5.3</jgrapht.version> <guava.version>33.7.1-jre</guava.version> + <!-- Guava's nullness-annotation transitive. Bump it together with guava.version, and + keep it equal to the value in that Guava release's guava-parent pom - never above. + It is pinned because JUnit 6 also declares org.jspecify:jspecify, at a nearer depth + than Guava, so without the managed entry below the daemon (lib) and worker + (lib-common) classpaths of the binary distribution mediate to different versions + and dedup-libs.py refuses to assemble the tarball. --> + <jspecify.version>1.0.1</jspecify.version> <auto-service.version>1.1.1</auto-service.version> <netty-tcnative.version>2.0.82.Final</netty-tcnative.version> <netty.version>4.2.17.Final</netty.version> @@ -700,6 +707,15 @@ <artifactId>guava</artifactId> <version>${guava.version}</version> </dependency> + <!-- Not declared by any module: managed so every module resolves the same jspecify + whether it arrives via Guava or, at a nearer depth, via JUnit. The binary + distribution's dedup-libs check requires the daemon and worker classpaths to + agree on every shared jar. --> + <dependency> + <groupId>org.jspecify</groupId> + <artifactId>jspecify</artifactId> + <version>${jspecify.version}</version> + </dependency> <dependency> <groupId>com.google.auto.service</groupId> <artifactId>auto-service</artifactId>
