I'm going to introduce a new label for all PRs that have been reviewed and received 'Approval Recommended' from the AI. This new label is also named as 'Approval Recommended' so that it helps us quickly filter out those PRs without any findings reported by AI. The review automation will add/remove this label automatically according to the review result.
PRs created by dependabot will not have this label as we already APPROVE them automatically if criteria meets. If there are no concerns/objections, I will start this from next Monday. Thanks and regards. On Mon, Sep 7, 2026 at 10:37 AM Gian Merlino <[email protected]> wrote: > I just wanted to reply to say that the Dependabot automation has been > helpful. It's a lot of work to manually review this kind of thing. Thank > you for taking the time to automate it. I'd be interested in learning more > about your setup, if you've written about it somewhere, or intend to. > > Gian > > On 2026/07/31 04:00:51 Frank Chen wrote: > > Hi everyone, > > > > Previously I set up a local pipeline to use my Codex subscription to > review > > all open PRs on a daily basis. It's really helpful as I see authors of > PRs > > accept most of the comments raised by AI. > > > > Now I'm using Codex to address two recurring maintenance challenges in > > Apache Druid. > > > > First, Dependabot raises many dependency-upgrade PRs, most of them > related > > to security vulnerabilities. Java dependency PRs frequently fail CI > because > > the upgrade also requires updates to license declarations such as > > licenses.yaml. When this happens, the PR waits for human intervention. > > > > Second, although CodeQL is configured, we rarely have enough time to > > investigate and resolve its findings. GitHub currently records > > approximately 3,900 security and code-quality findings. Some are false > > positives, but many are valid issues, and it is difficult to determine > > which findings should be addressed first. > > > > This is where AI assistance can help. Thanks to the generous and frequent > > usage reset from OpenAI recently, I now have enough token budget to help > > address these problems. > > > > Another local Codex-driven pipeline is set up to inspect Dependabot > > compatibility, investigate CI failures, propose or implement focused > fixes, > > and run targeted validation. > > > > For Dependabot PRs, the operating principles are: > > > > - Java and web-console dependency updates will generally be *APPROVED* > > after CI passes and compatibility checks confirm that the upgrade is > safe. > > - Large or breaking upgrades will be *CLOSED* automatically. For > > example, #19799 <https://github.com/apache/druid/pull/19799>, the > Guice > > 6-to-7 upgrade, was closed because it would require a broader Jakarta > > migration(even though we can use AI to help the migration but it would > > require some extra work) > > - Website dependency updates should follow #19788 > > <https://github.com/apache/druid/pull/19788>, which changes > validation > > to npm ci. Therefore, #19814 < > https://github.com/apache/druid/pull/19814> > > should be merged only after #19788. > > > > Recently, I reviewed and merged the following 36 Dependabot PRs. > > Merged Java/Maven Dependabot PRs > > > > - #19794 <https://github.com/apache/druid/pull/19794> — > > proto-google-common-protos 2.48.0 → 2.73.0 > > - #19795 <https://github.com/apache/druid/pull/19795> — JDBI 2.63.1 → > > 2.78 > > - #19796 <https://github.com/apache/druid/pull/19796> — AWS SDK > 2.40.0 → > > 2.49.6 > > - #19797 <https://github.com/apache/druid/pull/19797> — Hamcrest 2.2 > → > > 3.0 > > - #19798 <https://github.com/apache/druid/pull/19798> — Scrooge > 19.10.0 > > → 21.2.0 > > - #19800 <https://github.com/apache/druid/pull/19800> — Rhino Engine > > 1.8.1 → 1.9.1 > > - #19777 <https://github.com/apache/druid/pull/19777> — Animal > Sniffer > > Maven Plugin 1.23 → 1.27 > > - #19780 <https://github.com/apache/druid/pull/19780> — Curator > 5.8.0 → > > 5.9.0 > > - #19781 <https://github.com/apache/druid/pull/19781> — Quidem 0.11 → > > 0.12 > > - #19783 <https://github.com/apache/druid/pull/19783> — Avatica > 1.27.0 → > > 1.28.0 > > - #19784 <https://github.com/apache/druid/pull/19784> — Async HTTP > > Client 3.0.10 → 3.0.11 > > - #19785 <https://github.com/apache/druid/pull/19785> — Maven > Assembly > > Plugin 3.1.0 → 3.8.0 > > - #19786 <https://github.com/apache/druid/pull/19786> — Protobuf > 4.33.0 > > → 4.35.1 > > - #18588 <https://github.com/apache/druid/pull/18588> — gRPC Netty > > Shaded 1.65.1 → 1.75.0 > > - #18650 <https://github.com/apache/druid/pull/18650> — Protobuf > 3.25.8 > > → 4.33.0 > > - #18714 <https://github.com/apache/druid/pull/18714> — Protobuf > Maven > > Plugin 3.7.0 → 3.10.2 > > - #18271 <https://github.com/apache/druid/pull/18271> — Maven > Artifact > > 3.6.0 → 3.9.11 > > - #19756 <https://github.com/apache/druid/pull/19756> — LZ4 Java > 1.10.2 > > → 1.11.1 > > - #19757 <https://github.com/apache/druid/pull/19757> — Jetty 12.1.8 > → > > 12.1.11 > > - #19763 <https://github.com/apache/druid/pull/19763> — Thrift > 0.13.0 → > > 0.23.0 > > - #19760 <https://github.com/apache/druid/pull/19760> — PostgreSQL > > 42.7.11 → 42.7.12 > > - #19764 <https://github.com/apache/druid/pull/19764> — Thrift > 0.13.0 → > > 0.23.0 > > - #19546 <https://github.com/apache/druid/pull/19546> — Vert.x > 4.5.24 → > > 4.5.27 > > - #19490 <https://github.com/apache/druid/pull/19490> — Commons > > Configuration 2.10.1 → 2.15.0 > > - #19476 <https://github.com/apache/druid/pull/19476> — Async HTTP > > Client 3.0.2 → 3.0.10 > > - #18956 <https://github.com/apache/druid/pull/18956> — AssertJ Core > > 3.24.2 → 3.27.7 > > > > Merged web-console Dependabot PRs > > > > - #19506 <https://github.com/apache/druid/pull/19506> — > > serialize-javascript and terser-webpack-plugin > > - #19708 <https://github.com/apache/druid/pull/19708> — Axios 1.15.2 > → > > 1.18.0 > > - #19610 <https://github.com/apache/druid/pull/19610> — Webpack Dev > > Server 5.2.2 → 5.2.6 > > - #19256 <https://github.com/apache/druid/pull/19256> — Lodash > 4.17.21 → > > 4.18.1 > > - #19621 <https://github.com/apache/druid/pull/19621> — Form Data > 4.0.5 > > → 4.0.6 > > - #19694 <https://github.com/apache/druid/pull/19694> — Websocket > Driver > > 0.7.4 → 0.7.5 > > - #19710 <https://github.com/apache/druid/pull/19710> — Shell Quote > > 1.8.1 → 1.10.0 > > - #19733 <https://github.com/apache/druid/pull/19733> — Immutable > 4.3.0 > > → 4.3.9 > > - #19761 <https://github.com/apache/druid/pull/19761> — ws > > - #19762 <https://github.com/apache/druid/pull/19762> — HTTP Proxy > > Middleware 2.0.9 → 2.0.10 > > > > I also used a one-time pipeline to raise PRs to address CodeQL problems. > > Besides addressing existing problems, some static checks rules have also > > been updated to prevent some problems in future.These PRs are listed as > > follows. If anyone can approve them, I will appreciate it.Security and > > dependency vulnerabilities > > > > - #19806 <https://github.com/apache/druid/pull/19806> — Exclude > > vulnerable SnakeYAML from Cassandra storage > > - #19807 <https://github.com/apache/druid/pull/19807> — Upgrade > Nimbus > > JOSE JWT > > - #19808 <https://github.com/apache/druid/pull/19808> — Address > Jackson > > 1 and Netty vulnerabilities > > - #19809 <https://github.com/apache/druid/pull/19809> — Remove > > vulnerable legacy LZ4 dependency > > - #19812 <https://github.com/apache/druid/pull/19812> — Reject > newlines > > in redirect locations > > - #19813 <https://github.com/apache/druid/pull/19813> — Guard segment > > info paths against traversal > > - #19814 <https://github.com/apache/druid/pull/19814> — Address > website > > dependency vulnerabilities > > - #19815 <https://github.com/apache/druid/pull/19815> — Address > > web-console dependency vulnerabilities > > - #19822 <https://github.com/apache/druid/pull/19822> — Secure > temporary > > files and resource lookups > > - #19828 <https://github.com/apache/druid/pull/19828> — Strengthen > > cryptographic operations > > > > CodeQL and code-quality improvements > > > > - #19816 <https://github.com/apache/druid/pull/19816> — Address > > resource-lifetime warnings > > - #19818 <https://github.com/apache/druid/pull/19818> — Harden > > arithmetic and bounds checks > > - #19819 <https://github.com/apache/druid/pull/19819> — Replace > > deprecated JUnit assertions > > - #19820 <https://github.com/apache/druid/pull/19820> — Address > > control-flow and API warnings > > - #19821 <https://github.com/apache/druid/pull/19821> — Detect unused > > parameters and local variables > > - #19823 <https://github.com/apache/druid/pull/19823> — Address > nullness > > and type warnings > > - #19825 <https://github.com/apache/druid/pull/19825> — Disambiguate > > method names and overloads > > - #19826 <https://github.com/apache/druid/pull/19826> — Address > > formatting warnings > > - #19827 <https://github.com/apache/druid/pull/19827> — Address > > concurrency warnings > > - #19829 <https://github.com/apache/druid/pull/19829> — Remove > redundant > > Python assignments > > > > Reliability and supporting work > > > > - #19810 <https://github.com/apache/druid/pull/19810> — Avoid > sleeping > > while holding lifecycle locks > > - #19811 <https://github.com/apache/druid/pull/19811> — Release the > > record-supplier lock on validation failure > > - #19817 <https://github.com/apache/druid/pull/19817> — Wait for > Kafka > > partitions before publishing > > - #19788 <https://github.com/apache/druid/pull/19788> — Use npm ci > for > > website checks > > - #18301 <https://github.com/apache/druid/pull/18301> — Improve > offset > > auto-reset behavior > > > > The goal is to make dependency and security maintenance more continuous > and > > scalable while keeping compatibility assessment, breaking-change > decisions, > > and final responsibility with human maintainers. > > > > Best regards, > > Frank > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
