Hi, Zhang Li Thank you for working on this. My intention is not about how to maintain those patches. It’s about upstream first or forking as separate projects: meaning you either find a way to get those patches accepted by upstream, or you maintain your own forks with your own release schedule.
Both approaches look good to me. The point is simply: don’t leave unreviewed deps in your tree. On Thu, Oct 16, 2025, at 16:34, Zhang Li wrote: > Yes, you are right. these git-based deps are added due to limitations of > rust. for some reason, cargo does not work for a workspace project with > deps in local path. I'm looking for an approach to replace these git based > deps with official deps and customized patches. hope this can be done in > future releases. > > Zhang Li > > Xuanwo <[email protected]> 于2025年10月16日周四 12:54写道： > >> +1 binding >> >> Thank you for this release. >> >> One thing we should improve in the future is our dependencies. >> >> Many of our dependencies are git based making it difficult to assess >> whether they are appropriate or secure. Especially concerning are forks of >> ASF projects that are managed outside the ASF like datafusion and arrow. I >> hope the PPMC has a plan to address these before graduation. >> >> For example: >> >> ``` >> [patch.crates-io] >> # datafusion: branch=v49.0.0-blaze >> datafusion = { git = "https://github.com/auron-project/datafusion.git";, >> rev = "9034aeffb"} >> datafusion-common = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> datafusion-expr = { git = "https://github.com/auron-project/datafusion.git";, >> rev = "9034aeffb"} >> datafusion-datasource = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> datafusion-datasource-parquet = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> datafusion-execution = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> datafusion-optimizer = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> datafusion-physical-expr = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> datafusion-spark = { git = " >> https://github.com/auron-project/datafusion.git";, rev = "9034aeffb"} >> orc-rust = { git = "https://github.com/auron-project/datafusion-orc.git";, >> rev = "d7a4b8c"} >> >> # arrow: branch=v55.2.0-blaze >> arrow = { git = "https://github.com/auron-project/arrow-rs.git";, rev = >> "5de02520c"} >> arrow-arith = { git = "https://github.com/auron-project/arrow-rs.git";, >> rev = "5de02520c"} >> arrow-array = { git = "https://github.com/auron-project/arrow-rs.git";, >> rev = "5de02520c"} >> arrow-buffer = { git = "https://github.com/auron-project/arrow-rs.git";, >> rev = "5de02520c"} >> arrow-cast = { git = "https://github.com/auron-project/arrow-rs.git";, rev >> = "5de02520c"} >> arrow-data = { git = "https://github.com/auron-project/arrow-rs.git";, rev >> = "5de02520c"} >> arrow-ipc = { git = "https://github.com/auron-project/arrow-rs.git";, rev >> = "5de02520c"} >> arrow-ord = { git = "https://github.com/auron-project/arrow-rs.git";, rev >> = "5de02520c"} >> arrow-row = { git = "https://github.com/auron-project/arrow-rs.git";, rev >> = "5de02520c"} >> arrow-schema = { git = "https://github.com/auron-project/arrow-rs.git";, >> rev = "5de02520c"} >> arrow-select = { git = "https://github.com/auron-project/arrow-rs.git";, >> rev = "5de02520c"} >> arrow-string = { git = "https://github.com/auron-project/arrow-rs.git";, >> rev = "5de02520c"} >> parquet = { git = "https://github.com/auron-project/arrow-rs.git";, rev = >> "5de02520c"} >> >> # serde_json: branch=v1.0.96-blaze >> serde_json = { git = "https://github.com/auron-project/json";, rev = >> "95fa6cb" } >> ``` >> >> On Wed, Oct 15, 2025, at 19:44, Nicholas Jiang wrote: >> > +1(binding). >> > >> > Regards, >> > Nicholas Jiang >> > >> > On 2025/10/13 12:02:38 Zhang Li wrote: >> >> Hello Incubator Community, >> >> >> >> This is a call for a vote to release Apache Auron(Incubating) version >> >> 6.0.0-incubating-rc0 >> >> >> >> The Apache Auron community has voted on and approved a proposal to >> release >> >> Apache Auron(Incubating) version 6.0.0-incubating-rc0 >> >> >> >> We now kindly request the Incubator PMC members review and vote on this >> >> incubator release. >> >> >> >> Auron community vote thread: >> >> • https://lists.apache.org/thread/zokzbfkgv3rts1w1m6sotflj0odtrn5x >> >> Vote result thread: >> >> • https://lists.apache.org/thread/ktgof385j3ssgrolkzwp1cjcm8wlocwl >> >> The release candidate: >> >> • >> >> >> https://dist.apache.org/repos/dist/dev/incubator/auron/v6.0.0-incubating-rc0/ >> >> Git tag for the release: >> >> • https://github.com/apache/auron/releases/tag/v6.0.0-rc0 >> >> Public keys file: >> >> • https://dist.apache.org/repos/dist/release/incubator/auron/KEYS >> >> The change log is available in: >> >> • https://github.com/apache/auron/compare/v5.0.0...v6.0.0-rc0 >> >> >> >> The vote will be open for at least 72 hours or until the necessary >> number >> >> of votes are reached. >> >> >> >> Please vote accordingly: >> >> [ ] +1 approve >> >> [ ] +0 no opinion >> >> [ ] -1 disapprove with the reason >> >> >> >> More detailed checklist please refer: >> >> • >> >> >> https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist >> >> >> >> Steps to validate the release, Please refer to: >> >> • https://www.apache.org/info/verification.html >> >> >> >> Thanks, >> >> On behalf of Apache Auron(Incubating) community >> >> >> > >> > --------------------------------------------------------------------- >> > To unsubscribe, e-mail: [email protected] >> > For additional commands, e-mail: [email protected] >> >> -- >> Xuanwo >> >> https://xuanwo.io/ >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> >> -- Xuanwo https://xuanwo.io/ --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
