This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new fe9dd22977f build(deps): upgrade org.apache.maven.resolver from 1.3.1
to 2.0.23 (#20386)
fe9dd22977f is described below
commit fe9dd22977f95c8ff4c94f142e066f1ecee260b1
Author: Frank Chen <[email protected]>
AuthorDate: Thu Sep 24 10:05:09 2026 +0800
build(deps): upgrade org.apache.maven.resolver from 1.3.1 to 2.0.23 (#20386)
* Upgrade org.apache.maven.resolver from 1.3.1 to 2.0.23
Dependabot's individual bumps (#20371-#20376) were closed because a
piecemeal, single-artifact bump breaks the build: Resolver 2.0 removed
org.eclipse.aether.spi.locator.ServiceLocator/DefaultServiceLocator,
which is how PullDependencies (the `pull-deps` CLI tool, the only
consumer of maven-resolver in the codebase) bootstraps its
RepositorySystem.
Changes:
- PullDependencies/PullDependenciesTest: replace the
DefaultServiceLocator/MavenRepositorySystemUtils bootstrap with
RepositorySystemSupplier (maven-resolver-supplier-mvn3), and build
sessions via RepositorySystem#createSessionBuilder() instead of
MavenRepositorySystemUtils#newSession(). The session now also
propagates system properties, needed for POMs with JDK-version
profile activation (e.g. anything inheriting from
org.apache.commons:commons-parent) to resolve correctly.
- services/pom.xml, server/pom.xml: bump all org.apache.maven.resolver
artifacts to 2.0.23 via a new maven.resolver.version property;
rename maven-resolver-transport-http -> maven-resolver-transport-apache
(renamed upstream); drop org.apache.maven:maven-resolver-provider
(superseded by maven-resolver-supplier-mvn3, which pulls in a
matching maven-resolver-provider/maven-model-builder 3.9.x
transitively); widen httpclient from test to compile scope in
services (needed by maven-resolver-transport-apache at runtime).
server/pom.xml keeps connector-basic/transport-apache in sync since
it bundles them for the distribution classpath even though no
server source references them directly.
- licenses.yaml: update resolver artifact versions/notices, add
maven-resolver-supplier-mvn3, remove the now-unused
"Maven Artifact Resolver Provider" entry.
Verified: PullDependenciesTest passes (12/12), maven-enforcer's
requireUpperBoundDeps passes on both services and server, and a real
`pull-deps` run against Maven Central succeeds end-to-end with the new
stack.
* Group org.apache.maven.resolver dependabot updates
The six org.apache.maven.resolver:* artifacts must always move
together (they share one pinned version), and a 1.x -> 2.x major bump
needs coordinated source changes, not just a version bump. Grouping
them means dependabot opens one PR for the whole family instead of
six PRs that individually break the build.
* Replace javax.xml.bind.DatatypeConverter with java.util.HexFormat
ExportMetadata was the only reason services declared jakarta.xml.bind-api
directly (DatatypeConverter.parseHexBinary/printHexBinary). Since Druid
now targets Java 25, java.util.HexFormat (available since Java 17)
covers the same hex encode/decode without the extra dependency.
printHexBinary produced upper-case hex, so HEX_FORMAT is configured
with withUpperCase() to keep byte-for-byte identical export output;
parseHex accepts either case regardless of that setting, matching
parseHexBinary's behavior.
jakarta.xml.bind-api is still pulled in transitively (via
druid-processing) and its licenses.yaml entry is used by other
modules, so no further changes are needed there.
* Fix real CI failures from the resolver 2.x migration
Four CI jobs failed on the real build (static-checks-maven,
packaging-check-jdk25, docker-tests, web-checks), all tracing back to
two gaps in the earlier PullDependencies migration:
1. dependency:analyze flagged maven-resolver-connector-basic,
-transport-apache, -impl, and -spi as unused declared dependencies
in services: RepositorySystemSupplier wires them up via
ServiceLoader/SPI, not direct source references, same pattern
server/pom.xml already had a usedDependencies allowlist for.
2. The real functional bug: getRepositorySystemSession() built its
session via a bare repositorySystem.createSessionBuilder(), which
has none of Maven's default DependencySelector/DependencyManager/
DependencyTraverser wiring. Without the scope-based selector that
normally stops a dependency's own test/provided-scoped and optional
dependencies from propagating transitively, dependency collection
walked into druid-processing's test-scope equalsverifier dependency
and its long-dead declared repositories (an old SourceForge SVN
host), corrupting the local POM cache and failing pull-deps in the
real distribution build. Building the session via
SessionBuilderSupplier (the maven-resolver-supplier-mvn3 companion
to RepositorySystemSupplier) restores Maven-equivalent resolution
behavior, matching what MavenRepositorySystemUtils.newSession() did
under 1.3.1.
Verified locally with the exact CI command
(pull-deps -c org.apache.druid.extensions:druid-avro-extensions,
--defaultVersion, -l against a real ~/.m2 populated by mvn install):
previously failed after 5+ minutes walking into equalsverifier's dead
repos, now succeeds in seconds with no equalsverifier/springframework
resolution attempts.
* Fix CodeQL deprecation warnings for LocalRepository(String)
github-advanced-security flagged the LocalRepository(String) /
LocalRepository(File) constructor as deprecated in resolver 2.x (it's
being replaced by Path-based construction). Switch both call sites to
SessionBuilder#withLocalRepositoryBaseDirectories(Path), the
recommended 2.x replacement, which also avoids constructing a
LocalRepository at all. Also switched the test's LocalRepository
#getBasedir() (also deprecated, in favor of #getBasePath()) to match.
* Drop redundant SPI-only resolver dependencies from services/pom.xml
maven-resolver-connector-basic, -transport-apache, -impl, and -spi
were declared explicitly with a pinned version, but nothing in
services' source references them - they're only loaded via
ServiceLoader/SPI by RepositorySystemSupplier at runtime.
maven-resolver-supplier-mvn3 (already a direct dependency) pulls all
four in transitively at the same 2.0.23 version, so the explicit
declarations, their version overrides, and the usedDependencies
allowlist that existed purely to placate dependency:analyze are all
unnecessary. Keeping maven-resolver-api and -util declared explicitly,
since PullDependencies imports classes from both directly.
* Move org.apache.maven.resolver version pinning to root
dependencyManagement
Matches the existing pattern used for other centrally-managed
dependencies like org.apache.httpcomponents:httpclient. services/pom.xml
and server/pom.xml now declare these dependencies without an explicit
<version>, inheriting it from the root pom's dependencyManagement
entry (still keyed off the single maven.resolver.version property), so
there's one place to bump the version instead of several.
* Make PullDependenciesTest's fixture use SessionBuilderSupplier too
Review comment on apache/druid#20386: RealRepositorySystemUtil built
its session with a bare system.createSessionBuilder(), unlike
production's getRepositorySystemSession(), which uses
SessionBuilderSupplier specifically to get Maven's default scope-based
DependencySelector/DependencyManager/DependencyTraverser wiring. Since
all run() tests stub resolveDependencies for the injected session, a
future regression that dropped SessionBuilderSupplier from production
(reintroducing the equalsverifier-style dead-repository traversal bug)
would not have been caught by this test suite. Align the fixture with
production so it does.
---
.github/dependabot.yml | 8 ++++
licenses.yaml | 51 ++++++++--------------
pom.xml | 26 +++++++++++
server/pom.xml | 16 +++----
services/pom.xml | 48 ++++++++------------
.../java/org/apache/druid/cli/ExportMetadata.java | 12 +++--
.../org/apache/druid/cli/PullDependencies.java | 41 +++++++++--------
.../org/apache/druid/cli/PullDependenciesTest.java | 34 +++++----------
8 files changed, 119 insertions(+), 117 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index da9a028512f..dce1f3394b6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,14 @@ updates:
# Protect against not-yet-discovered regressions or security issues in
new releases of dependencies
#
https://github.blog/changelog/2025-07-01-dependabot-supports-configuration-of-a-minimum-package-age/
default-days: 14
+ groups:
+ # The individual org.apache.maven.resolver:* artifacts must move
together: they are all
+ # pinned to the same version in services/pom.xml and server/pom.xml, and
a 1.x -> 2.x major
+ # bump also requires coordinated source/bootstrap changes in
PullDependencies (see the
+ # 2.0.23 upgrade PR). A single-artifact bump breaks the build with a
mixed 1.x/2.x graph.
+ maven-resolver:
+ patterns:
+ - "org.apache.maven.resolver:*"
ignore:
# pin ZooKeeper dependencies to 3.5.x
- dependency-name: "org.apache.zookeeper"
diff --git a/licenses.yaml b/licenses.yaml
index f09aba55aa3..7fe2fa6335d 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -2068,27 +2068,6 @@ notices:
Copyright 2001-2018 The Apache Software Foundation
---
-name: Maven Artifact Resolver Provider
-license_category: binary
-module: java-core
-license_name: Apache License version 2.0
-version: 3.6.0
-libraries:
- - org.apache.maven: maven-resolver-provider
- - org.apache.maven: maven-model
- - org.apache.maven: maven-model-builder
-notices:
- - maven-resolver-provider: |
- Maven Artifact Resolver Provider
- Copyright 2001-2018 The Apache Software Foundation
- - maven-model: |
- Maven Model
- Copyright 2001-2018 The Apache Software Foundation
- - maven-model-builder: |
- Maven Model Builder
- Copyright 2001-2018 The Apache Software Foundation
----
-
name: Apache Maven Artifact
license_category: binary
module: java-core
@@ -2106,38 +2085,42 @@ name: Maven Artifact Resolver Connector Basic
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 1.3.1
+version: 2.0.23
libraries:
- org.apache.maven.resolver: maven-resolver-connector-basic
- org.apache.maven.resolver: maven-resolver-spi
- org.apache.maven.resolver: maven-resolver-api
- org.apache.maven.resolver: maven-resolver-util
+ - org.apache.maven.resolver: maven-resolver-supplier-mvn3
notices:
- maven-resolver-connector-basic: |
Maven Artifact Resolver Connector Basic
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
- maven-resolver-spi: |
Maven Artifact Resolver SPI
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
- maven-resolver-api: |
Maven Artifact Resolver API
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
- maven-resolver-util: |
Maven Artifact Resolver Utilities
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
+ - maven-resolver-supplier-mvn3: |
+ Maven Artifact Resolver Instance Supplier Maven3
+ Copyright 2001-2026 The Apache Software Foundation
---
-name: Maven Artifact Resolver Transport HTTP
+name: Maven Artifact Resolver Transport Apache
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 1.3.1
+version: 2.0.23
libraries:
- - org.apache.maven.resolver: maven-resolver-transport-http
+ - org.apache.maven.resolver: maven-resolver-transport-apache
notices:
- - maven-resolver-transport-http: |
- Maven Artifact Resolver Transport HTTP
- Copyright 2001-2018 The Apache Software Foundation
+ - maven-resolver-transport-apache: |
+ Maven Artifact Resolver Transport Apache
+ Copyright 2001-2026 The Apache Software Foundation
---
@@ -2145,13 +2128,13 @@ name: Maven Artifact Resolver Implementation
license_category: binary
module: java-core
license_name: Apache License version 2.0
-version: 1.3.1
+version: 2.0.23
libraries:
- org.apache.maven.resolver: maven-resolver-impl
notices:
- maven-resolver-impl: |
Maven Artifact Resolver Implementation
- Copyright 2001-2018 The Apache Software Foundation
+ Copyright 2001-2026 The Apache Software Foundation
---
name: Plexus Component Annotations
diff --git a/pom.xml b/pom.xml
index 36d8cce0079..f9688e5dcca 100644
--- a/pom.xml
+++ b/pom.xml
@@ -74,6 +74,7 @@
<maven.compiler.release>${java.version}</maven.compiler.release>
<project.build.resourceEncoding>UTF-8</project.build.resourceEncoding>
<aether.version>1.1.0</aether.version>
+ <maven.resolver.version>2.0.23</maven.resolver.version>
<apache.curator.version>5.9.0</apache.curator.version>
<apache.kafka.version>4.3.1</apache.kafka.version>
<!-- when updating apache ranger, verify the usage of aws-bundle-sdk
vs aws-logs-sdk
@@ -1056,6 +1057,31 @@
<artifactId>aether-util</artifactId>
<version>${aether.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.maven.resolver</groupId>
+ <artifactId>maven-resolver-api</artifactId>
+ <version>${maven.resolver.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.maven.resolver</groupId>
+ <artifactId>maven-resolver-util</artifactId>
+ <version>${maven.resolver.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.maven.resolver</groupId>
+ <artifactId>maven-resolver-supplier-mvn3</artifactId>
+ <version>${maven.resolver.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.maven.resolver</groupId>
+ <artifactId>maven-resolver-connector-basic</artifactId>
+ <version>${maven.resolver.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.maven.resolver</groupId>
+ <artifactId>maven-resolver-transport-apache</artifactId>
+ <version>${maven.resolver.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
diff --git a/server/pom.xml b/server/pom.xml
index d9cbd2a2ab2..c0634e744a0 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -128,19 +128,16 @@
<artifactId>jsr305</artifactId>
</dependency>
<dependency>
+ <!-- Not used directly by druid-server source; bundled here (in
sync with the
+ versions services/pom.xml declares for
org.apache.druid.cli.PullDependencies)
+ so the resolver connector/transport jars are present on the
assembled
+ distribution classpath. -->
<groupId>org.apache.maven.resolver</groupId>
<artifactId>maven-resolver-connector-basic</artifactId>
- <version>1.3.1</version>
</dependency>
<dependency>
<groupId>org.apache.maven.resolver</groupId>
- <artifactId>maven-resolver-transport-http</artifactId>
- <version>1.3.1</version>
- </dependency>
- <dependency>
- <groupId>org.apache.maven</groupId>
- <artifactId>maven-resolver-provider</artifactId>
- <version>3.6.0</version>
+ <artifactId>maven-resolver-transport-apache</artifactId>
</dependency>
<dependency>
<groupId>com.amazonaws</groupId>
@@ -498,8 +495,7 @@
<configuration>
<usedDependencies>
<!-- These are needed for scope: compile -->
-
<dependency>org.apache.maven:maven-resolver-provider</dependency>
-
<dependency>org.apache.maven.resolver:maven-resolver-transport-http</dependency>
+
<dependency>org.apache.maven.resolver:maven-resolver-transport-apache</dependency>
<dependency>org.apache.maven.resolver:maven-resolver-connector-basic</dependency>
<!-- These are needed for scope: runtime -->
<dependency>org.xerial.snappy:snappy-java</dependency>
diff --git a/services/pom.xml b/services/pom.xml
index 1b768cc2a71..38eb1d03f17 100644
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -200,54 +200,40 @@
<artifactId>guice-servlet</artifactId>
</dependency>
<dependency>
+ <!-- Used directly by PullDependencies
(RepositorySystem/RepositorySystemSession). -->
<groupId>org.apache.maven.resolver</groupId>
- <artifactId>maven-resolver-connector-basic</artifactId>
- <version>1.3.1</version>
- </dependency>
- <dependency>
- <groupId>org.apache.maven.resolver</groupId>
- <artifactId>maven-resolver-transport-http</artifactId>
- <version>1.3.1</version>
+ <artifactId>maven-resolver-api</artifactId>
</dependency>
<dependency>
+ <!-- Used directly by PullDependencies (JavaScopes,
DependencyFilterUtils,
+ AuthenticationBuilder, DefaultProxySelector). -->
<groupId>org.apache.maven.resolver</groupId>
<artifactId>maven-resolver-util</artifactId>
- <version>1.3.1</version>
</dependency>
<dependency>
+ <!-- Replaces the pre-2.0
DefaultServiceLocator/MavenRepositorySystemUtils bootstrap
+ (formerly provided by
org.apache.maven:maven-resolver-provider) used in
+ PullDependencies to construct a
RepositorySystem/RepositorySystemSession.
+ It transitively brings in maven-resolver-connector-basic,
-impl, -spi,
+ -transport-apache, and -transport-file at a consistent
version, so those
+ don't need to be declared here directly - nothing in this
module's source
+ references them; they're only used via ServiceLoader/SPI at
runtime. -->
<groupId>org.apache.maven.resolver</groupId>
- <artifactId>maven-resolver-impl</artifactId>
- <version>1.3.1</version>
- </dependency>
- <dependency>
- <groupId>org.apache.maven.resolver</groupId>
- <artifactId>maven-resolver-spi</artifactId>
- <version>1.3.1</version>
- </dependency>
- <dependency>
- <groupId>org.apache.maven.resolver</groupId>
- <artifactId>maven-resolver-api</artifactId>
- <version>1.3.1</version>
+ <artifactId>maven-resolver-supplier-mvn3</artifactId>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-artifact</artifactId>
</dependency>
<dependency>
- <groupId>org.apache.maven</groupId>
- <artifactId>maven-resolver-provider</artifactId>
- <version>3.6.0</version>
- </dependency>
- <dependency>
+ <!-- plexus-utils 4.x (pulled transitively via
maven-artifact/maven-model-builder) moved
+ its XML pull-parser classes
(org.codehaus.plexus.util.xml.pull.*) out into this
+ module; maven-model-builder needs them at runtime to parse
POMs. -->
<groupId>org.codehaus.plexus</groupId>
<artifactId>plexus-xml</artifactId>
<version>3.1.0</version>
<scope>runtime</scope>
</dependency>
- <dependency>
- <groupId>jakarta.xml.bind</groupId>
- <artifactId>jakarta.xml.bind-api</artifactId>
- </dependency>
<dependency>
<groupId>org.jdbi</groupId>
<artifactId>jdbi</artifactId>
@@ -283,9 +269,11 @@
<scope>test</scope>
</dependency>
<dependency>
+ <!-- Widened from test to compile: maven-resolver-transport-apache
needs Apache
+ HttpClient (not just httpcore, which it already pulls
transitively) at runtime
+ to talk to remote repositories. -->
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
- <scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
diff --git a/services/src/main/java/org/apache/druid/cli/ExportMetadata.java
b/services/src/main/java/org/apache/druid/cli/ExportMetadata.java
index c5b548da14c..549dc81f5bd 100644
--- a/services/src/main/java/org/apache/druid/cli/ExportMetadata.java
+++ b/services/src/main/java/org/apache/druid/cli/ExportMetadata.java
@@ -49,12 +49,12 @@ import org.apache.druid.timeline.DataSegment;
import org.apache.druid.timeline.DataSegment.PruneSpecsHolder;
import javax.annotation.Nullable;
-import javax.xml.bind.DatatypeConverter;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.ArrayList;
+import java.util.HexFormat;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
@@ -201,6 +201,10 @@ public class ExportMetadata extends GuiceRunnable
private static final ObjectMapper JSON_MAPPER = new DefaultObjectMapper();
+ // Upper case to match the format previously produced by
javax.xml.bind.DatatypeConverter#printHexBinary.
+ // Parsing (parseHex) accepts either case regardless of this setting.
+ private static final HexFormat HEX_FORMAT = HexFormat.of().withUpperCase();
+
public ExportMetadata()
{
super(log);
@@ -434,7 +438,7 @@ public class ExportMetadata extends GuiceRunnable
String payload
) throws IOException
{
- DataSegment segment =
JSON_MAPPER.readValue(DatatypeConverter.parseHexBinary(payload),
DataSegment.class);
+ DataSegment segment = JSON_MAPPER.readValue(HEX_FORMAT.parseHex(payload),
DataSegment.class);
String uniqueId = getUniqueIDFromLocalLoadSpec(segment.getLoadSpec());
String segmentPath =
DataSegmentPusher.getDefaultStorageDirWithExistingUniquePath(segment, uniqueId);
@@ -453,7 +457,7 @@ public class ExportMetadata extends GuiceRunnable
String serialized = JSON_MAPPER.writeValueAsString(segment);
if (useHexBlobs) {
- return DatatypeConverter.printHexBinary(StringUtils.toUtf8(serialized));
+ return HEX_FORMAT.formatHex(StringUtils.toUtf8(serialized));
} else {
return serialized;
}
@@ -468,7 +472,7 @@ public class ExportMetadata extends GuiceRunnable
if (useHexBlobs) {
return payload;
}
- return StringUtils.fromUtf8(DatatypeConverter.parseHexBinary(payload));
+ return StringUtils.fromUtf8(HEX_FORMAT.parseHex(payload));
}
private String convertBooleanString(final String booleanString)
diff --git a/services/src/main/java/org/apache/druid/cli/PullDependencies.java
b/services/src/main/java/org/apache/druid/cli/PullDependencies.java
index 9e617cc16a8..d1c0f1ea59c 100644
--- a/services/src/main/java/org/apache/druid/cli/PullDependencies.java
+++ b/services/src/main/java/org/apache/druid/cli/PullDependencies.java
@@ -32,27 +32,21 @@ import org.apache.druid.java.util.common.ISE;
import org.apache.druid.java.util.common.StringUtils;
import org.apache.druid.java.util.common.logger.Logger;
import org.apache.maven.artifact.resolver.ArtifactNotFoundException;
-import org.apache.maven.repository.internal.MavenRepositorySystemUtils;
-import org.eclipse.aether.DefaultRepositorySystemSession;
import org.eclipse.aether.RepositorySystem;
import org.eclipse.aether.RepositorySystemSession;
import org.eclipse.aether.artifact.Artifact;
import org.eclipse.aether.artifact.DefaultArtifact;
import org.eclipse.aether.collection.CollectRequest;
-import org.eclipse.aether.connector.basic.BasicRepositoryConnectorFactory;
import org.eclipse.aether.graph.Dependency;
import org.eclipse.aether.graph.DependencyNode;
-import org.eclipse.aether.impl.DefaultServiceLocator;
-import org.eclipse.aether.repository.LocalRepository;
import org.eclipse.aether.repository.Proxy;
import org.eclipse.aether.repository.RemoteRepository;
import org.eclipse.aether.resolution.ArtifactResult;
import org.eclipse.aether.resolution.DependencyRequest;
import org.eclipse.aether.resolution.DependencyResolutionException;
import org.eclipse.aether.resolution.DependencyResult;
-import org.eclipse.aether.spi.connector.RepositoryConnectorFactory;
-import org.eclipse.aether.spi.connector.transport.TransporterFactory;
-import org.eclipse.aether.transport.http.HttpTransporterFactory;
+import org.eclipse.aether.supplier.RepositorySystemSupplier;
+import org.eclipse.aether.supplier.SessionBuilderSupplier;
import org.eclipse.aether.util.artifact.JavaScopes;
import org.eclipse.aether.util.filter.DependencyFilterUtils;
import org.eclipse.aether.util.repository.AuthenticationBuilder;
@@ -60,6 +54,7 @@ import
org.eclipse.aether.util.repository.DefaultProxySelector;
import java.io.File;
import java.io.IOException;
+import java.nio.file.Path;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
@@ -201,17 +196,29 @@ public class PullDependencies implements Runnable
private RepositorySystem getRepositorySystem()
{
- DefaultServiceLocator locator =
MavenRepositorySystemUtils.newServiceLocator();
- locator.addService(RepositoryConnectorFactory.class,
BasicRepositoryConnectorFactory.class);
- locator.addService(TransporterFactory.class, HttpTransporterFactory.class);
- return locator.getService(RepositorySystem.class);
+ // RepositorySystemSupplier (maven-resolver-supplier-mvn3) replaces the
pre-2.0
+ // DefaultServiceLocator/ServiceLocator bootstrap. It wires up the basic
repository
+ // connector and the Apache HTTP transporter out of the box.
+ return new RepositorySystemSupplier().get();
}
protected RepositorySystemSession getRepositorySystemSession()
{
- DefaultRepositorySystemSession session =
MavenRepositorySystemUtils.newSession();
- LocalRepository localRepo = new LocalRepository(localRepository);
-
session.setLocalRepositoryManager(repositorySystem.newLocalRepositoryManager(session,
localRepo));
+ // SessionBuilderSupplier (maven-resolver-supplier-mvn3) sets up
Maven-equivalent
+ // DependencySelector/DependencyManager/DependencyTraverser defaults on
the builder -
+ // in particular, the scope-based selector that keeps a dependency's own
"test"/"provided"
+ // scoped and optional dependencies from propagating transitively,
matching real Maven
+ // resolution behavior. A bare repositorySystem.createSessionBuilder() has
none of that,
+ // and will walk into every transitive branch (e.g. druid-processing's
test-scope
+ // equalsverifier dependency and its own dead/unreachable declared
repositories).
+ RepositorySystemSession.SessionBuilder sessionBuilder = new
SessionBuilderSupplier(repositorySystem).get()
+
.withLocalRepositoryBaseDirectories(Path.of(localRepository))
+
// Some artifacts' POMs (e.g. those inheriting from
org.apache.commons:commons-parent)
+
// use JDK-version-conditional <profiles>. The model
builder invoked while
+
// resolving descriptors needs "java.version" (and
friends) to evaluate those
+
// profile activations; without this the build fails
with
+
// "Failed to determine Java version for profile
...".
+
.setSystemProperties(System.getProperties());
// Set up the proxy configuration if required
if (useProxy) {
@@ -228,10 +235,10 @@ public class PullDependencies implements Runnable
final DefaultProxySelector proxySelector = new DefaultProxySelector();
proxySelector.add(proxy, null);
- session.setProxySelector(proxySelector);
+ sessionBuilder.setProxySelector(proxySelector);
}
- return session;
+ return sessionBuilder.build();
}
protected List<RemoteRepository> getRemoteRepositories()
diff --git
a/services/src/test/java/org/apache/druid/cli/PullDependenciesTest.java
b/services/src/test/java/org/apache/druid/cli/PullDependenciesTest.java
index f9a59d7329b..847787f575b 100644
--- a/services/src/test/java/org/apache/druid/cli/PullDependenciesTest.java
+++ b/services/src/test/java/org/apache/druid/cli/PullDependenciesTest.java
@@ -23,17 +23,13 @@ import com.google.common.collect.ImmutableList;
import org.apache.druid.guice.ExtensionsConfig;
import org.apache.druid.java.util.common.StringUtils;
import org.apache.druid.testing.TemporaryFolderExtension;
-import org.apache.maven.repository.internal.MavenRepositorySystemUtils;
-import org.eclipse.aether.DefaultRepositorySystemSession;
import org.eclipse.aether.RepositorySystem;
import org.eclipse.aether.RepositorySystemSession;
import org.eclipse.aether.artifact.Artifact;
import org.eclipse.aether.artifact.DefaultArtifact;
-import org.eclipse.aether.connector.basic.BasicRepositoryConnectorFactory;
import org.eclipse.aether.graph.DefaultDependencyNode;
import org.eclipse.aether.graph.Dependency;
import org.eclipse.aether.graph.DependencyNode;
-import org.eclipse.aether.impl.DefaultServiceLocator;
import org.eclipse.aether.repository.Authentication;
import org.eclipse.aether.repository.LocalRepository;
import org.eclipse.aether.repository.Proxy;
@@ -42,9 +38,8 @@ import org.eclipse.aether.resolution.ArtifactRequest;
import org.eclipse.aether.resolution.ArtifactResult;
import org.eclipse.aether.resolution.DependencyRequest;
import org.eclipse.aether.resolution.DependencyResult;
-import org.eclipse.aether.spi.connector.RepositoryConnectorFactory;
-import org.eclipse.aether.spi.connector.transport.TransporterFactory;
-import org.eclipse.aether.transport.http.HttpTransporterFactory;
+import org.eclipse.aether.supplier.RepositorySystemSupplier;
+import org.eclipse.aether.supplier.SessionBuilderSupplier;
import org.eclipse.aether.util.artifact.JavaScopes;
import org.eclipse.aether.util.repository.AuthenticationBuilder;
import org.junit.jupiter.api.Assertions;
@@ -54,6 +49,7 @@ import org.junit.jupiter.api.extension.RegisterExtension;
import java.io.File;
import java.io.IOException;
+import java.nio.file.Path;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
@@ -302,10 +298,10 @@ public class PullDependenciesTest
pullDependencies.proxyUsername = "user";
pullDependencies.proxyPassword = "password";
- DefaultRepositorySystemSession session = (DefaultRepositorySystemSession)
pullDependencies.getRepositorySystemSession();
+ RepositorySystemSession session =
pullDependencies.getRepositorySystemSession();
LocalRepository localRepo =
session.getLocalRepositoryManager().getRepository();
- Assertions.assertEquals(pullDependencies.localRepository,
localRepo.getBasedir().getAbsolutePath());
+
Assertions.assertEquals(Path.of(pullDependencies.localRepository).toAbsolutePath(),
localRepo.getBasePath().toAbsolutePath());
Proxy proxy = session.getProxySelector().getProxy(
new RemoteRepository.Builder("test", "default",
"http://example.com";).build()
@@ -327,9 +323,9 @@ public class PullDependenciesTest
public void testGetRepositorySystemSessionWithoutProxyConfiguration()
{
pullDependencies.useProxy = false;
- DefaultRepositorySystemSession session = (DefaultRepositorySystemSession)
pullDependencies.getRepositorySystemSession();
+ RepositorySystemSession session =
pullDependencies.getRepositorySystemSession();
LocalRepository localRepo =
session.getLocalRepositoryManager().getRepository();
- Assertions.assertEquals(pullDependencies.localRepository,
localRepo.getBasedir().getAbsolutePath());
+
Assertions.assertEquals(Path.of(pullDependencies.localRepository).toAbsolutePath(),
localRepo.getBasePath().toAbsolutePath());
Proxy proxy = session.getProxySelector().getProxy(
new RemoteRepository.Builder("test", "default",
"http://example.com";).build()
);
@@ -340,23 +336,17 @@ public class PullDependenciesTest
{
public static RepositorySystem newRepositorySystem()
{
- DefaultServiceLocator locator =
MavenRepositorySystemUtils.newServiceLocator();
- locator.addService(RepositoryConnectorFactory.class,
BasicRepositoryConnectorFactory.class);
- locator.addService(TransporterFactory.class,
HttpTransporterFactory.class);
- return locator.getService(RepositorySystem.class);
+ return new RepositorySystemSupplier().get();
}
- public static DefaultRepositorySystemSession newRepositorySystemSession(
+ public static RepositorySystemSession newRepositorySystemSession(
RepositorySystem system,
String localRepoPath
)
{
- DefaultRepositorySystemSession session =
MavenRepositorySystemUtils.newSession();
-
- LocalRepository localRepo = new LocalRepository(localRepoPath);
-
session.setLocalRepositoryManager(system.newLocalRepositoryManager(session,
localRepo));
-
- return session;
+ return new SessionBuilderSupplier(system).get()
+
.withLocalRepositoryBaseDirectories(Path.of(localRepoPath))
+ .build();
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
