This is an automated email from the ASF dual-hosted git repository.
voonhous pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hudi.git
The following commit(s) were added to refs/heads/master by this push:
new 26c0c084bcff fix(build): stop hudi-presto-bundle depending on another
bundle (#19490)
26c0c084bcff is described below
commit 26c0c084bcff63f9f73fad8fcc002e8412bd3f4f
Author: Ranga Reddy <[email protected]>
AuthorDate: Fri Aug 14 14:48:02 2026 +0530
fix(build): stop hudi-presto-bundle depending on another bundle (#19490)
hudi-hadoop-mr-bundle is a shaded fat jar, and hudi-presto-bundle depended
on it while
shading classes that jar already contains. #19433 declared hudi-hadoop-mr
and
hudi-hadoop-common directly, which left the bundle dependency redundant.
Removing it also drops the org.codehaus.jackson:* entry from the
artifactSet, because
that include has been dead since #6893 (779a96506fb7, "Use jackson-v2
import instead of
jackson-v1", 2022) deleted the org.codehaus.jackson. relocation next to it
and the root
pom's jackson-asl dependencies. No Java or Scala source in the tree
references the
package today, so the include only ever matched classes reached
transitively.
Both are removed together because the include is what makes the bundle
dependency
visible in the jar, and only on one of the two ways this bundle is built:
variant repository-resolution full-reactor (what ships)
master 7273 classes / 651 jackson 6650 classes / 0 jackson
this change 6650 classes / 0 jackson 6650 classes / 0 jackson
A reactor build resolves hudi-hadoop-mr-bundle from the reactor and never
reads its
published POM, so Jackson 1.x never reaches this bundle and the include
matches nothing.
Resolving from the repository reads the reduced POM, which lists
jackson-core-asl and
jackson-mapper-asl since #19433 turned on promoteTransitiveDependencies,
and 623 classes
land in the jar unrelocated under org/codehaus/jackson/. Releases confirm
which of the
two is the contract: scripts/release/deploy_staging_jars.sh builds the full
reactor, and
1.0.2 through 1.2.0 all ship 0 such entries.
After this change both paths agree, at the same 6650 classes the released
jars carry, so
the repository path no longer publishes a jar that differs from the
released one, and
jackson-mapper-asl 1.9.13 - the top of CVE-2019-10172's range, with no fix
in the ASL 1.x
line - stays off Presto's classpath.
The published dependency-reduced POM loses exactly one entry on the reactor
path,
hudi-hadoop-mr-bundle itself.
Closes #19469
---
packaging/hudi-presto-bundle/pom.xml | 6 ------
1 file changed, 6 deletions(-)
diff --git a/packaging/hudi-presto-bundle/pom.xml
b/packaging/hudi-presto-bundle/pom.xml
index e5b03a6ccc9c..e5853e4e1376 100644
--- a/packaging/hudi-presto-bundle/pom.xml
+++ b/packaging/hudi-presto-bundle/pom.xml
@@ -78,7 +78,6 @@
<include>org.apache.parquet:parquet-avro</include>
<include>org.apache.avro:avro</include>
<include>com.github.ben-manes.caffeine:caffeine</include>
- <include>org.codehaus.jackson:*</include>
<include>org.apache.commons:commons-lang3</include>
<include>com.yammer.metrics:metrics-core</include>
<include>commons-io:commons-io</include>
@@ -191,11 +190,6 @@
<artifactId>hudi-common</artifactId>
<version>${project.version}</version>
</dependency>
- <dependency>
- <groupId>org.apache.hudi</groupId>
- <artifactId>hudi-hadoop-mr-bundle</artifactId>
- <version>${project.version}</version>
- </dependency>
<!-- Both are shaded in by the artifactSet above. Declared directly rather
than relying on
hudi-hadoop-mr-bundle to supply them transitively, so this bundle's
shade inputs do not depend
on another bundle's published dependency list. -->
