Apache Druid dependency PR triage — 2026-09-05 Repository: apache/druid Cohort: 11 open Dependabot PRs titled build(deps...) or build(deps-dev...).
Outcome - APPROVED: #20256 AWS SDK 2.54.8→2.54.10; #20257 grpc-context 1.83.1→1.84.0; #20258 Parquet 1.18.0→1.18.1; #20259 grpc-api 1.83.1→1.84.0; #20260 git-commit-id Maven plugin 10.0.0→10.0.1; #20261 OSHI 7.6.0→7.6.1; #20263 grpc-netty-shaded 1.83.1→1.84.0; #20265 grpc-bom 1.83.1→1.84.0; #20266 checker-qual 4.2.2→4.2.3. - CLOSED / BLOCKED: #20262 Vert.x 4.5.28→5.1.7. The major-version upgrade breaks the existing Fabric8 Vert.x 4 integration at compilation; a safe fix requires a separate integration migration. - CLOSED / CONCERN: #20264 Google API Client 2.7.2→2.9.1. No japicmp incompatibility was found, but HTTP-family and truststore behavior changes require dedicated GCP/GCE, custom-truststore, mTLS, TLS-fallback, and dependency-isolation validation. - Java source changed: NO for all 11 PRs. - No PRs were merged. Repairs pushed - #20256: f2ad8a9d32e068fec3c1b1c95a2417aae5393280 - #20257: 9ff309f053decd29826c78b850e9d7824c8bc39f - #20258: 451059b874e146042ba10b2ca5a50362a00223ae - #20259: a5491b9fdf6cbd055c918cf23368620d9aef1638 - #20261: 7a3c568f57c900c9bb0d3680c31eaa4925fa661a - #20264: e34080af780b266d5cec30bc6db4da52bad22dee - #20266: 386d20cb1494623039121d7fbaa4d085e07093e9 These are POM/license/dependency metadata repairs only; no Java source was added or modified. CI and review notes - The nine approved PRs have approvals posted at their exact current heads. #20256, #20257, #20258, #20260, #20263, and #20266 are fully green; #20259, #20261, and #20265 each retain one independently classified unrelated terminal failure. - Review bodies identify Codex GPT-5.6 Luna(max) and include the compatibility verdict and Java-source result. - Run-owned worktrees, branches, packets, diffs, and temporary run files were removed; the dirty parent checkout and pre-existing worktrees were preserved. - The requested 15-minute heartbeat could not be created because the Codex app rejected the persistent external-action automation under its risk policy. No workaround or duplicate automation was created. Next run: 2026-09-06. This report was prepared by Codex GPT-5.6 Luna(max); no merge action was taken. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
