Sounds great to me. On Tue, Oct 13, 2026 at 6:44 AM Frank Chen <[email protected]> wrote:
> I'm going to introduce a new label for all PRs that have been reviewed and > received 'Approval Recommended' from the AI. > This new label is also named as 'Approval Recommended' so that it helps us > quickly filter out those PRs without any findings reported by AI. > The review automation will add/remove this label automatically according to > the review result. > > PRs created by dependabot will not have this label as we already APPROVE > them automatically if criteria meets. > > If there are no concerns/objections, I will start this from next Monday. > > Thanks and regards. > > > On Mon, Sep 7, 2026 at 10:37 AM Gian Merlino <[email protected]> wrote: > > > I just wanted to reply to say that the Dependabot automation has been > > helpful. It's a lot of work to manually review this kind of thing. Thank > > you for taking the time to automate it. I'd be interested in learning > more > > about your setup, if you've written about it somewhere, or intend to. > > > > Gian > > > > On 2026/07/31 04:00:51 Frank Chen wrote: > > > Hi everyone, > > > > > > Previously I set up a local pipeline to use my Codex subscription to > > review > > > all open PRs on a daily basis. It's really helpful as I see authors of > > PRs > > > accept most of the comments raised by AI. > > > > > > Now I'm using Codex to address two recurring maintenance challenges in > > > Apache Druid. > > > > > > First, Dependabot raises many dependency-upgrade PRs, most of them > > related > > > to security vulnerabilities. Java dependency PRs frequently fail CI > > because > > > the upgrade also requires updates to license declarations such as > > > licenses.yaml. When this happens, the PR waits for human intervention. > > > > > > Second, although CodeQL is configured, we rarely have enough time to > > > investigate and resolve its findings. GitHub currently records > > > approximately 3,900 security and code-quality findings. Some are false > > > positives, but many are valid issues, and it is difficult to determine > > > which findings should be addressed first. > > > > > > This is where AI assistance can help. Thanks to the generous and > frequent > > > usage reset from OpenAI recently, I now have enough token budget to > help > > > address these problems. > > > > > > Another local Codex-driven pipeline is set up to inspect Dependabot > > > compatibility, investigate CI failures, propose or implement focused > > fixes, > > > and run targeted validation. > > > > > > For Dependabot PRs, the operating principles are: > > > > > > - Java and web-console dependency updates will generally be > *APPROVED* > > > after CI passes and compatibility checks confirm that the upgrade is > > safe. > > > - Large or breaking upgrades will be *CLOSED* automatically. For > > > example, #19799 <https://github.com/apache/druid/pull/19799>, the > > Guice > > > 6-to-7 upgrade, was closed because it would require a broader > Jakarta > > > migration(even though we can use AI to help the migration but it > would > > > require some extra work) > > > - Website dependency updates should follow #19788 > > > <https://github.com/apache/druid/pull/19788>, which changes > > validation > > > to npm ci. Therefore, #19814 < > > https://github.com/apache/druid/pull/19814> > > > should be merged only after #19788. > > > > > > Recently, I reviewed and merged the following 36 Dependabot PRs. > > > Merged Java/Maven Dependabot PRs > > > > > > - #19794 <https://github.com/apache/druid/pull/19794> — > > > proto-google-common-protos 2.48.0 → 2.73.0 > > > - #19795 <https://github.com/apache/druid/pull/19795> — JDBI > 2.63.1 → > > > 2.78 > > > - #19796 <https://github.com/apache/druid/pull/19796> — AWS SDK > > 2.40.0 → > > > 2.49.6 > > > - #19797 <https://github.com/apache/druid/pull/19797> — Hamcrest > 2.2 > > → > > > 3.0 > > > - #19798 <https://github.com/apache/druid/pull/19798> — Scrooge > > 19.10.0 > > > → 21.2.0 > > > - #19800 <https://github.com/apache/druid/pull/19800> — Rhino > Engine > > > 1.8.1 → 1.9.1 > > > - #19777 <https://github.com/apache/druid/pull/19777> — Animal > > Sniffer > > > Maven Plugin 1.23 → 1.27 > > > - #19780 <https://github.com/apache/druid/pull/19780> — Curator > > 5.8.0 → > > > 5.9.0 > > > - #19781 <https://github.com/apache/druid/pull/19781> — Quidem > 0.11 → > > > 0.12 > > > - #19783 <https://github.com/apache/druid/pull/19783> — Avatica > > 1.27.0 → > > > 1.28.0 > > > - #19784 <https://github.com/apache/druid/pull/19784> — Async HTTP > > > Client 3.0.10 → 3.0.11 > > > - #19785 <https://github.com/apache/druid/pull/19785> — Maven > > Assembly > > > Plugin 3.1.0 → 3.8.0 > > > - #19786 <https://github.com/apache/druid/pull/19786> — Protobuf > > 4.33.0 > > > → 4.35.1 > > > - #18588 <https://github.com/apache/druid/pull/18588> — gRPC Netty > > > Shaded 1.65.1 → 1.75.0 > > > - #18650 <https://github.com/apache/druid/pull/18650> — Protobuf > > 3.25.8 > > > → 4.33.0 > > > - #18714 <https://github.com/apache/druid/pull/18714> — Protobuf > > Maven > > > Plugin 3.7.0 → 3.10.2 > > > - #18271 <https://github.com/apache/druid/pull/18271> — Maven > > Artifact > > > 3.6.0 → 3.9.11 > > > - #19756 <https://github.com/apache/druid/pull/19756> — LZ4 Java > > 1.10.2 > > > → 1.11.1 > > > - #19757 <https://github.com/apache/druid/pull/19757> — Jetty > 12.1.8 > > → > > > 12.1.11 > > > - #19763 <https://github.com/apache/druid/pull/19763> — Thrift > > 0.13.0 → > > > 0.23.0 > > > - #19760 <https://github.com/apache/druid/pull/19760> — PostgreSQL > > > 42.7.11 → 42.7.12 > > > - #19764 <https://github.com/apache/druid/pull/19764> — Thrift > > 0.13.0 → > > > 0.23.0 > > > - #19546 <https://github.com/apache/druid/pull/19546> — Vert.x > > 4.5.24 → > > > 4.5.27 > > > - #19490 <https://github.com/apache/druid/pull/19490> — Commons > > > Configuration 2.10.1 → 2.15.0 > > > - #19476 <https://github.com/apache/druid/pull/19476> — Async HTTP > > > Client 3.0.2 → 3.0.10 > > > - #18956 <https://github.com/apache/druid/pull/18956> — AssertJ > Core > > > 3.24.2 → 3.27.7 > > > > > > Merged web-console Dependabot PRs > > > > > > - #19506 <https://github.com/apache/druid/pull/19506> — > > > serialize-javascript and terser-webpack-plugin > > > - #19708 <https://github.com/apache/druid/pull/19708> — Axios > 1.15.2 > > → > > > 1.18.0 > > > - #19610 <https://github.com/apache/druid/pull/19610> — Webpack Dev > > > Server 5.2.2 → 5.2.6 > > > - #19256 <https://github.com/apache/druid/pull/19256> — Lodash > > 4.17.21 → > > > 4.18.1 > > > - #19621 <https://github.com/apache/druid/pull/19621> — Form Data > > 4.0.5 > > > → 4.0.6 > > > - #19694 <https://github.com/apache/druid/pull/19694> — Websocket > > Driver > > > 0.7.4 → 0.7.5 > > > - #19710 <https://github.com/apache/druid/pull/19710> — Shell Quote > > > 1.8.1 → 1.10.0 > > > - #19733 <https://github.com/apache/druid/pull/19733> — Immutable > > 4.3.0 > > > → 4.3.9 > > > - #19761 <https://github.com/apache/druid/pull/19761> — ws > > > - #19762 <https://github.com/apache/druid/pull/19762> — HTTP Proxy > > > Middleware 2.0.9 → 2.0.10 > > > > > > I also used a one-time pipeline to raise PRs to address CodeQL > problems. > > > Besides addressing existing problems, some static checks rules have > also > > > been updated to prevent some problems in future.These PRs are listed as > > > follows. If anyone can approve them, I will appreciate it.Security and > > > dependency vulnerabilities > > > > > > - #19806 <https://github.com/apache/druid/pull/19806> — Exclude > > > vulnerable SnakeYAML from Cassandra storage > > > - #19807 <https://github.com/apache/druid/pull/19807> — Upgrade > > Nimbus > > > JOSE JWT > > > - #19808 <https://github.com/apache/druid/pull/19808> — Address > > Jackson > > > 1 and Netty vulnerabilities > > > - #19809 <https://github.com/apache/druid/pull/19809> — Remove > > > vulnerable legacy LZ4 dependency > > > - #19812 <https://github.com/apache/druid/pull/19812> — Reject > > newlines > > > in redirect locations > > > - #19813 <https://github.com/apache/druid/pull/19813> — Guard > segment > > > info paths against traversal > > > - #19814 <https://github.com/apache/druid/pull/19814> — Address > > website > > > dependency vulnerabilities > > > - #19815 <https://github.com/apache/druid/pull/19815> — Address > > > web-console dependency vulnerabilities > > > - #19822 <https://github.com/apache/druid/pull/19822> — Secure > > temporary > > > files and resource lookups > > > - #19828 <https://github.com/apache/druid/pull/19828> — Strengthen > > > cryptographic operations > > > > > > CodeQL and code-quality improvements > > > > > > - #19816 <https://github.com/apache/druid/pull/19816> — Address > > > resource-lifetime warnings > > > - #19818 <https://github.com/apache/druid/pull/19818> — Harden > > > arithmetic and bounds checks > > > - #19819 <https://github.com/apache/druid/pull/19819> — Replace > > > deprecated JUnit assertions > > > - #19820 <https://github.com/apache/druid/pull/19820> — Address > > > control-flow and API warnings > > > - #19821 <https://github.com/apache/druid/pull/19821> — Detect > unused > > > parameters and local variables > > > - #19823 <https://github.com/apache/druid/pull/19823> — Address > > nullness > > > and type warnings > > > - #19825 <https://github.com/apache/druid/pull/19825> — > Disambiguate > > > method names and overloads > > > - #19826 <https://github.com/apache/druid/pull/19826> — Address > > > formatting warnings > > > - #19827 <https://github.com/apache/druid/pull/19827> — Address > > > concurrency warnings > > > - #19829 <https://github.com/apache/druid/pull/19829> — Remove > > redundant > > > Python assignments > > > > > > Reliability and supporting work > > > > > > - #19810 <https://github.com/apache/druid/pull/19810> — Avoid > > sleeping > > > while holding lifecycle locks > > > - #19811 <https://github.com/apache/druid/pull/19811> — Release the > > > record-supplier lock on validation failure > > > - #19817 <https://github.com/apache/druid/pull/19817> — Wait for > > Kafka > > > partitions before publishing > > > - #19788 <https://github.com/apache/druid/pull/19788> — Use npm ci > > for > > > website checks > > > - #18301 <https://github.com/apache/druid/pull/18301> — Improve > > offset > > > auto-reset behavior > > > > > > The goal is to make dependency and security maintenance more continuous > > and > > > scalable while keeping compatibility assessment, breaking-change > > decisions, > > > and final responsibility with human maintainers. > > > > > > Best regards, > > > Frank > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > >
