amaechler opened a new pull request, #20673: URL: https://github.com/apache/druid/pull/20673
Closes #19300. ### Description This PR switches Druid to Google's `libraries-bom` for the Google client libraries, which fixes a set of out-of-sync and outdated Google versions. Before this change, Google versions were pinned artifact by artifact and drifted apart. `lib/` shipped an older stack (through `druid-gcp-common`) than `druid-google-extensions`, and since extensions load parent-first, `google-cloud-storage` actually ran on the older `lib/` jars. Inside the extension, `grpc-api`/`grpc-context` were pinned to 1.84 while the rest of grpc was 1.83. #### Changes - Import `com.google.cloud:libraries-bom` 26.90.0 in the root `dependencyManagement`, after the explicit entries so Druid's own versions keep precedence. Dependabot bumps the single `com.google.cloud.libraries-bom.version` property. - Remove the per-artifact Google versions the BOM now manages (`google-api-client`, `google-http-client`, `google-cloud-storage`, `gax`, `google-cloud-core` and the grpc pins). - Pin `org.graalvm.sdk:nativeimage`/`word` and `protobuf-java-util`, which the BOM would otherwise move backwards. - Keep contrib grpc at 1.84: `opentelemetry-emitter` imports `grpc-bom` at `shade.grpc.version`, and `grpc-query` pins `proto-google-common-protos` to what `grpc-protobuf` 1.84 declares. - Update `licenses.yaml`. #### Resulting versions A dependency diff of every module against master changes only Google artifacts: | Artifact | Where | Before | After | | --- | --- | --- | --- | | `google-auth-library-credentials`, `-oauth2-http` | `lib/` | 1.30.0 | 1.54.0 | | `grpc-api`, `grpc-context` | `lib/` | 1.70.0 | 1.83.0 | | `google-oauth-client` | `lib/` | 1.36.0 | 1.39.0 | | `google-http-client-apache-v2`, `-gson` | `lib/` | 1.45.2 | 2.2.0 | | `api-common` | `lib/` | not shipped | 2.70.0 | | `grpc-api`, `grpc-context` | `druid-google-extensions` | 1.84.0 | 1.83.0 | | `google-cloud-monitoring`, `proto-google-cloud-monitoring-v3` | `druid-google-extensions` | 3.52.0 | 3.100.0 | | `protobuf-java-util` | `druid-google-extensions` | 4.33.6 | 4.36.2 | #### Testing No core code uses the Google client, so the `lib/` jumps only matter to extensions. On a local cluster against `fake-gcs-server` with GCS deep storage, task logs and MSQ intermediate storage, an MSQ ingest from `gs://`, segment push and load, a durable-storage query, task log retrieval and a kill task all worked, with no linkage errors in any service or task log. The kubeconfig `auth-provider: gcp` path in `druid-kubernetes-extensions`, which also uses `google-auth-library` from `lib/`, still refreshes tokens. CVE-2026-33186, the motivation for #19300, is a gRPC-Go advisory (`google.golang.org/grpc`) and does not affect grpc-java. #### Release note Druid's `lib/` directory now ships the same Google client library versions as `druid-google-extensions` (`google-auth-library` 1.54, grpc 1.83, `google-http-client` 2.2.0), managed through Google's `libraries-bom`. Custom extensions that use the Google client jars from `lib/` now run against these versions. <hr> This PR has: - [x] been self-reviewed. - [x] a release note entry in the PR description. - [x] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md) - [x] been tested in a test Druid cluster. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
