This is an automated email from the ASF dual-hosted git repository. tuhaihe pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry-pxf.git
commit 1fc7e9f5f32ac1c503c642e4d8928c2415a0a3b6 Author: Dianjin Wang <[email protected]> AuthorDate: Tue Sep 15 19:09:06 2026 +0800 Remove org.json, an ASF Category X dependency org.json:json:20090211 is declared in pxf-hive as an `implementation` dependency, so it is packed into the pxf-service Spring Boot application JAR and ships inside every convenience RPM, DEB and tarball we publish. Its license carries the "The Software shall be used for Good, not Evil" clause. The ASF moved the JSON license to Category X on 2016-11-03, which forbids it in any Apache release, source or binary. This is a release blocker that documentation cannot fix: the dependency has to go. Nothing in PXF references org.json. The declaration is annotated "transitive dependency required by MapR", which does not apply to Apache Cloudberry. Remove it along with its dependencyManagement pin. Verified on Rocky 9: the build succeeds, the full unit test suite stays green (1807 tests, 0 failures), and the application JAR drops from 153 bundled JARs to 152 with json-20090211.jar gone. See: https://www.apache.org/legal/resolved.html#category-x Backpatch-through: REL_2_STABLE (cherry picked from commit 02eae0020f6e0129eb76cbf56c632bbc69630c88) --- server/build.gradle | 1 - server/pxf-hive/build.gradle | 3 --- 2 files changed, 4 deletions(-) diff --git a/server/build.gradle b/server/build.gradle index 08e5b116..cb1a5df6 100644 --- a/server/build.gradle +++ b/server/build.gradle @@ -110,7 +110,6 @@ configure(javaProjects) { dependency("org.datanucleus:datanucleus-api-jdo:4.2.4") dependency("org.datanucleus:datanucleus-core:4.1.17") dependency("org.jodd:jodd-core:3.5.2") - dependency("org.json:json:20090211") dependency("org.mortbay.jetty:jetty-util:6.1.26") dependency("org.objenesis:objenesis:2.1") diff --git a/server/pxf-hive/build.gradle b/server/pxf-hive/build.gradle index 764815a9..4f2ec65c 100644 --- a/server/pxf-hive/build.gradle +++ b/server/pxf-hive/build.gradle @@ -64,9 +64,6 @@ dependencies { // transitive dependency for reading Hive tables with SerDe 'org.apache.hadoop.hive.serde2.OpenCSVSerde' implementation("net.sf.opencsv:opencsv") { transitive = false } - // transitive dependency required by MapR - implementation("org.json:json:20090211") { transitive = false } - /******************************* * Test Dependencies *******************************/ --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
