FrankChen021 opened a new issue, #20525: URL: https://github.com/apache/druid/issues/20525
Druid currently has 1,911 open CodeQL `java/deprecated-call` alerts across 579 files. Most occur in test sources, but 488 are in production sources. [CodeQL alerts](https://github.com/apache/druid/security/code-scanning?query=is%3Aopen+branch%3Amaster+rule%3Ajava%2Fdeprecated-call) This issue tracks migrating deprecated API calls, removing obsolete internal Druid APIs, and adding enforcement where practical. The counts below reflect the alert inventory retrieved on October 8, 2026, and may change as fixes land. ### Major cleanup areas | API group | Alerts | |---|---:| | SQL expression test helpers | 470 | | `DataSegment` constructors and no-argument `builder()` | 420 | | `URL` constructors | 101 | | Calcite rule operand APIs | 95 | | `SeekableStreamSupervisorSpec.getDataSchema()` | 52 | | `JvmUtils.getRuntimeInfo()` | 47 | | Guava `Throwables` methods | 43 | | `QueryRunnerFactory.mergeRunners(ExecutorService, …)` | 41 | ### Proposed approach **Druid APIs** Migrate callers to the supported replacements and remove deprecated internal declarations in the same change. Removal candidates should be outside the API surface protected by `@PublicApi` or `@ExtensionPoint`. Check annotations on individual members and contracts inherited from parent classes or interfaces, as well as annotations on the declaring class. Separately review methods used by serialization, configuration, HTTP endpoints, persisted metadata, reflection, or dependency injection. These may have compatibility requirements even without either annotation. **Dependency and JDK APIs** Follow the replacement guidance for each dependency while preserving behavior. Split the work into focused PRs by API family or module. For deprecated `URL` constructors: - Replace ordinary construction with `URI` followed by `toURL()`. - Use `Path.toUri()` or `File.toURI()` for filesystem paths. - Review relative URLs, escaping, exception handling, and custom `URLStreamHandler` usage. - Add all deprecated URL constructor overloads to `codestyle/druid-forbidden-apis.txt` to prevent regressions. ### Cases requiring care - `DataSegment.builder(SegmentId)` has different defaults from the deprecated no-argument builder. Preserve existing values where necessary. - SQL expression tests should compare complete typed `DruidExpression` structures when migrating away from deprecated helpers. - Compatibility bridges in extension APIs require an explicit compatibility decision before removal. - Replacing `ResourcePool` finalization requires preserving resource cleanup behavior. - Hashing changes must preserve compatibility with existing partition assignments and persisted identifiers. - Guava exception propagation replacements must preserve checked exceptions, unchecked exceptions, and null handling. ### Completion criteria - [ ] Migrate deprecated calls in focused batches. - [ ] Remove deprecated internal Druid APIs that no longer need compatibility support. - [ ] Add forbidden API rules for deprecated URL constructors. - [ ] Run affected tests and static checks for each batch. - [ ] Confirm resolved alerts after CodeQL rescans. - [ ] Document any retained deprecated calls and the specific reason for retaining them. Blanket suppression or removing deprecation annotations solely to silence warnings should not be used to resolve this issue. --- Disclosure: This issue was prepared and created by Codex, an OpenAI AI assistant, on behalf of @FrankChen021, who reviewed the description and authorized its submission. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
