Repository navigation
fix(deps): ship Avatica 1.29.0 and let Renovate update the Tycho target - #130
Merged
Merged
Conversation
The update site ships the library versions listed in MatCalciteTargetPlatform.target, not the ones in the poms. Renovate updated only the poms, so the plugin shipped calcite-core 1.36.0, avatica-core 1.23.0, guava 32.1.3-jre, janino 3.1.9 and json-smart 2.5.0 while MatCalcitePlugin/pom.xml said 1.41.0, 33.7.2-jre, 3.1.12 and 2.6.0. Avatica before 1.29.0 has CVE-2026-70410 (unsafe reflection in plugin instantiation). A Renovate regex manager now reads the Maven dependencies of .target files. Renovate names the branch after the dependency, so a version listed in both a pom and the target is updated in one PR. The versions in the poms move to dependencyManagement in the root pom. The target pins avatica-core 1.29.0 over the version Calcite asks for, and takes guava, json-smart and janino at the pom versions. Avatica 1.29.0 needs joou, and the plugin now imports org.joou: the wrapped bundles import everything optionally, so without the import the joou bundle is neither wired nor shipped, and Calcite fails with NoClassDefFoundError: org/joou/UByte. calcite-core in the pom goes back to 1.36.0, the version that ships. Moving the target to 1.41.0 fails the OSGi resolution of the plugin on Eclipse 2022-12: Missing requirement: json-path 2.9.0 requires 'java.package; org.slf4j [2.0.0,3.0.0)' but it could not be found User-visible: The update site ships avatica-core 1.29.0, guava 33.7.2-jre, janino 3.1.12, json-smart 2.6.0 and joou 0.9.4. Not changed: The update site still ships calcite-core 1.36.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
vlsi
force-pushed
the
renovate-tycho-target
branch
from
November 8, 2026 20:19
e463be0 to
c736417
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The update site ships the library versions listed in
MatCalciteTargetPlatform.target, not the ones in the poms, and Renovate updated only the poms. Onmainthe update site carries calcite-core 1.36.0, avatica-core 1.23.0, guava 32.1.3-jre, janino 3.1.9 and json-smart 2.5.0, whileMatCalcitePlugin/pom.xmlsays 1.41.0, 33.7.2-jre, 3.1.12 and 2.6.0. Avatica before 1.29.0 has CVE-2026-70410.A Renovate regex manager now reads the Maven dependencies of
.targetfiles. Renovate names the branch after the dependency, so a version listed in both a pom and the target is updated in one PR. The versions in the poms move to<dependencyManagement>in the root pom. The target pins avatica-core 1.29.0, and the plugin importsorg.joou, which Avatica 1.29.0 needs: the wrapped bundles import everything optionally, so without the import Calcite fails withNoClassDefFoundError: org/joou/UByte.calcite-core in the pom goes back to 1.36.0, the version that ships. Moving the target to 1.41.0 fails the OSGi resolution on Eclipse 2022-12:
A local
renovate --platform=local --dry-run=lookup(Renovate 44.222.4) put calcite-core, guava and json-smart from both files into the same branches (renovate/org.apache.calcite-calcite-core-1.x,renovate/guava-monorepo,renovate/json-smart-v2-monorepo). The update site built from this branch,MatCalciteRepository/target/repository/plugins, has avatica-core 1.29.0, guava 33.7.2-jre, janino and commons-compiler 3.1.12, json-smart 2.6.0 and joou 0.9.4.Scope. Calcite 1.42 needs the platform upgrade in #121, so Renovate's calcite-core PR, which now covers the pom and the target, fails CI until #121 lands. #121 changes the same lines of the root pom, the plugin pom, the target and the manifest, and needs a rebase after this PR. httpclient5 and httpcore5 are not added: the tests pass without them, and the plugin runs Calcite locally, without Avatica's HTTP client.
🤖 Generated with Claude Code