This is an automated email from the ASF dual-hosted git repository.
tuhaihe pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry-pxf.git
The following commit(s) were added to refs/heads/main by this push:
new 02eae002 Remove org.json, an ASF Category X dependency
02eae002 is described below
commit 02eae0020f6e0129eb76cbf56c632bbc69630c88
Author: Dianjin Wang <[email protected]>
AuthorDate: Tue Sep 15 19:09:06 2026 +0800
Remove org.json, an ASF Category X dependency
org.json:json:20090211 is declared in pxf-hive as an
`implementation` dependency, so it is packed into the pxf-service
Spring Boot application JAR and ships inside every convenience RPM,
DEB and tarball we publish.
Its license carries the "The Software shall be used for Good, not
Evil" clause. The ASF moved the JSON license to Category X on
2016-11-03, which forbids it in any Apache release, source or
binary. This is a release blocker that documentation cannot fix:
the dependency has to go.
Nothing in PXF references org.json. The declaration is annotated
"transitive dependency required by MapR", which does not apply to
Apache Cloudberry. Remove it along with its dependencyManagement
pin.
Verified on Rocky 9: the build succeeds, the full unit test suite
stays green (1807 tests, 0 failures), and the application JAR drops
from 153 bundled JARs to 152 with json-20090211.jar gone.
See: https://www.apache.org/legal/resolved.html#category-x
Backpatch-through: REL_2_STABLE
---
server/build.gradle | 1 -
server/pxf-hive/build.gradle | 3 ---
2 files changed, 4 deletions(-)
diff --git a/server/build.gradle b/server/build.gradle
index 463e03d2..1f7af772 100644
--- a/server/build.gradle
+++ b/server/build.gradle
@@ -115,7 +115,6 @@ configure(javaProjects) {
dependency("org.datanucleus:datanucleus-api-jdo:4.2.4")
dependency("org.datanucleus:datanucleus-core:4.1.17")
dependency("org.jodd:jodd-core:3.5.2")
- dependency("org.json:json:20090211")
dependency("org.mortbay.jetty:jetty-util:6.1.26")
dependency("org.objenesis:objenesis:2.1")
diff --git a/server/pxf-hive/build.gradle b/server/pxf-hive/build.gradle
index 764815a9..4f2ec65c 100644
--- a/server/pxf-hive/build.gradle
+++ b/server/pxf-hive/build.gradle
@@ -64,9 +64,6 @@ dependencies {
// transitive dependency for reading Hive tables with SerDe
'org.apache.hadoop.hive.serde2.OpenCSVSerde'
implementation("net.sf.opencsv:opencsv") {
transitive = false }
- // transitive dependency required by MapR
- implementation("org.json:json:20090211") {
transitive = false }
-
/*******************************
* Test Dependencies
*******************************/
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
