aglinxinyuan opened a new issue, #8292:
URL: https://github.com/apache/texera/issues/8292
### What happened?
`build / pyamber (ubuntu-latest, 3.12)` went red repo-wide on 2026-08-31, on
every open PR, whatever the PR touches. The failing step is **Check installed
Python packages against per-module LICENSE-binary files** (it runs on the
3.12
leg only; 3.11 and 3.13 skip it), and the whole failure is one line:
```
NEW Python packages not claimed by LICENSE-binary:
+ cloudpickle==3.1.2 (license: BSD License) -> add to
amber/LICENSE-binary-python
```
Root cause is upstream, not in any PR: **joblib 1.6.0 stopped vendoring
cloudpickle.**
| | joblib 1.5.3 | joblib 1.6.0 |
| --- | --- | --- |
| `joblib/externals/cloudpickle/` in the wheel | present (vendored) |
**gone** |
| `Requires-Dist` | *(none)* | `cloudpickle>=3.0` |
| visible to `pip-licenses` | no | **yes** |
`amber/operator-requirements.txt` reaches joblib transitively, so pip now
installs cloudpickle as a distribution of its own:
```
operator-requirements.txt -> scikit-learn==1.7.2 -> joblib>=1.2.0 ->
cloudpickle>=3.0
```
```
Before: any PR -> pyamber 3.12 -> "+ cloudpickle==3.1.2"
-> red
After: any PR -> pyamber 3.12 -> "OK: 110 Python packages match ..."
-> green
```
It is time-based, not PR-based:
| Run | Created (UTC) | pyamber 3.12 license step |
| --- | --- | --- |
| 33373952988 (#8282) | 08:39 | success |
| 33374737272 (#8286) | 08:49 | success |
| 33392828233 (`ci/8084-...`) | 12:39 | **failure** |
| 33394216939 (#7703) | 12:55 | **failure** |
Two notes on reading the log:
- The long `DRIFT (transitive, informational)` list under the `+` line is
**not**
fatal. PR runs pass `--ignore-transitive-version`, and the nightly
exact-match
check on `main` owns refreshing those pins. It should not be bulk-bumped
here.
- A sibling matrix leg reports `cancelled` (3.13 on #7703, 3.11 on
`ci/8084-...`). That is `fail-fast` collateral, not a second failure.
cloudpickle 3.1.2 is BSD-3-Clause -- its wheel METADATA says
`License: BSD-3-Clause`, and PyPI's classifier reports only the generic
`BSD License` that shows up in the CI line. That is ASF Category A, the wheel
ships no `NOTICE`, and `licenses/LICENSE-BSD-3-Clause.txt` already carries
the
text, so one bullet in `amber/LICENSE-binary-python` is the entire fix.
### How to reproduce?
Any PR against `main` shows it. To reproduce the check itself without a full
`pip install`, rebuild the manifest's claimed set at the versions CI actually
installed and feed it to the checker:
```bash
python bin/licensing/check_binary_deps.py --ignore-transitive-version python
/tmp/pip-licenses.csv
```
where `/tmp/pip-licenses.csv` is `Name,Version,License` rows for every
`- name==version` bullet in `amber/LICENSE-binary-python`, plus
`cloudpickle,3.1.2,BSD License`. It exits 1 with the `+ cloudpickle==3.1.2`
line above; adding the bullet makes it exit 0 with
`OK: 110 Python packages match LICENSE-binary.`
To confirm the upstream cause directly:
```bash
pip download joblib==1.5.3 --no-deps -d . && pip download joblib==1.6.0
--no-deps -d .
# unzip each; 1.6.0's METADATA has `Requires-Dist: cloudpickle>=3.0`
# and no joblib/externals/cloudpickle/ directory.
```
### Version/Branch
1.3.0-incubating-SNAPSHOT (main)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
