aglinxinyuan commented on PR #7264: URL: https://github.com/apache/texera/pull/7264#issuecomment-5161796809
Pushed 87ca804 to get this green. Three of the grouped bumps are not actually safe patches, and none of the `LICENSE-binary` / `NOTICE-binary` files had been synced. ### Held back | Bump | Why it breaks | | --- | --- | | `io.dropwizard:* 4.0.7 → 4.0.17` | Two independent breaks. (1) It resolves jersey **3.0.18**, but the root `build.sbt` `dependencyOverrides` pin `jersey-common` at **3.0.12** for `FileService` / `WorkflowCompilingService`. `ResourceConfig` in jersey-server 3.0.18 implements `org.glassfish.jersey.ApplicationSupplier`, which does not exist in jersey-common 3.0.12 — scalac fails at `RoleAnnotationEnforcer.enforce`: `Class org.glassfish.jersey.ApplicationSupplier not found - continuing with a stub`. (2) It resolves **jackson 2.21.0**, while `jackson-module-scala` is pinned at `2.18.8`, which requires databind `>= 2.18.0 && < 2.19.0` — every resource spec dies with `ExceptionInInitializerError` / `Scala module 2.18.8 requires Jackson Databind version ... Found 2.21.0`. Moving dropwizard 4.x needs a deliberate jackson upgrade first, so it stays at `4.0.7`. | | `org.playframework:play-json 3.1.0-M1 → 3.1.0-M10` | Drags **jackson-databind 2.21.2** into `ConfigService`, which (unlike `FileService`) has no databind override — `ConfigResourceSpec` aborts with the same jackson-module-scala mismatch. Also a milestone-to-milestone jump rather than a patch. | | `io.kubernetes:client-java 21.0.0 → 21.0.2-legacy` | The `-legacy` classifier is a separate artifact line, picked only because it sorts above the plain `21.0.2` that also exists. It pulls `jakarta.ws.rs-api 4.0.0` (JAX-RS 4.0) and `httpclient 4.5.14` under a JAX-RS 3.1 Dropwizard. Retargeted to plain **`21.0.2`**, which keeps `jakarta.ws.rs-api` at 3.1.0. | ### Licensing Every remaining bump needed the binary-license bookkeeping that was missing — this is what made `platform (computing-unit-managing-service)` fail on `NOTICE-binary differs from generator output`: - direct + transitive version entries refreshed in all six service `LICENSE-binary` files and `amber/LICENSE-binary-java`; - `amber/LICENSE-binary-java` jar set adjusted for dropwizard `1.3.29`'s changed transitive closure — `com.papertrail:profiler:1.0.2` is gone, replaced by `com.helger:profiler:1.1.1` (Apache-2.0), plus new `javax.activation:javax.activation-api:1.2.0` (CDDL 1.1) and `org.eclipse.jetty:jetty-util-ajax:9.4.58` (Apache-2.0); - all seven `NOTICE-binary` files regenerated with `bin/licensing/generate_notice_binary.py` from freshly built dists. ### Verified locally (JDK 17) - `Test/compile` clean across the build; `scalafmtCheckAll` and `scalafixAll --check` clean. - Previously failing suites now pass: `AccessControlService` (37), `ConfigService` (34), `NotebookMigrationService` (26), `ComputingUnitManagingService` (73), `WorkflowCompilingService` (4). - All seven dists built, then `check_binary_deps.py --ignore-transitive-version` + the `generate_notice_binary.py` diff run exactly as `build.yml` does — clean for all seven. - `WorkflowExecutionService/test` failures are byte-identical to base `436b37e` (local-only e2e / Iceberg / Windows issues), so nothing here regressed amber. - `FileService`'s testcontainers suites were not run locally (no Docker on this machine); CI covers them. One follow-up worth considering separately: `renovate.json5` already disables lockstep families like arrow/pandas. `io.dropwizard` 4.x is coupled to jackson the same way, so a similar rule would stop this bump from reappearing each week. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
