From c736417f959b2b6e3b1d650d566ee00ec34a2f66 Mon Sep 17 00:00:00 2001 From: Vladimir Sitnikov Date: Sun, 8 Nov 2026 11:21:38 +0300 Subject: [PATCH] fix(deps): ship Avatica 1.29.0 and let Renovate update the Tycho target The update site ships the library versions listed in MatCalciteTargetPlatform.target, not the ones in the poms. Renovate updated only the poms, so the plugin shipped calcite-core 1.36.0, avatica-core 1.23.0, guava 32.1.3-jre, janino 3.1.9 and json-smart 2.5.0 while MatCalcitePlugin/pom.xml said 1.41.0, 33.7.2-jre, 3.1.12 and 2.6.0. Avatica before 1.29.0 has CVE-2026-70410 (unsafe reflection in plugin instantiation). A Renovate regex manager now reads the Maven dependencies of .target files. Renovate names the branch after the dependency, so a version listed in both a pom and the target is updated in one PR. The versions in the poms move to dependencyManagement in the root pom. The target pins avatica-core 1.29.0 over the version Calcite asks for, and takes guava, json-smart and janino at the pom versions. Avatica 1.29.0 needs joou, and the plugin now imports org.joou: the wrapped bundles import everything optionally, so without the import the joou bundle is neither wired nor shipped, and Calcite fails with NoClassDefFoundError: org/joou/UByte. calcite-core in the pom goes back to 1.36.0, the version that ships. Moving the target to 1.41.0 fails the OSGi resolution of the plugin on Eclipse 2022-12: Missing requirement: json-path 2.9.0 requires 'java.package; org.slf4j [2.0.0,3.0.0)' but it could not be found User-visible: The update site ships avatica-core 1.29.0, guava 33.7.2-jre, janino 3.1.12, json-smart 2.6.0 and joou 0.9.4. Not changed: The update site still ships calcite-core 1.36.0. Co-Authored-By: Claude Opus 5.5 --- MatCalcitePlugin/META-INF/MANIFEST.MF | 1 + MatCalcitePlugin/pom.xml | 9 --- .../MatCalciteTargetPlatform.target | 22 ++++++- pom.xml | 60 +++++++++++++++++++ renovate.json | 15 ++++- 5 files changed, 94 insertions(+), 13 deletions(-) diff --git a/MatCalcitePlugin/META-INF/MANIFEST.MF b/MatCalcitePlugin/META-INF/MANIFEST.MF index efaef41..f8500b8 100644 --- a/MatCalcitePlugin/META-INF/MANIFEST.MF +++ b/MatCalcitePlugin/META-INF/MANIFEST.MF @@ -49,4 +49,5 @@ Import-Package: com.fasterxml.jackson.core.util, org.apache.commons.text.similarity, org.codehaus.commons.compiler, org.codehaus.janino, + org.joou, org.locationtech.jts.geom diff --git a/MatCalcitePlugin/pom.xml b/MatCalcitePlugin/pom.xml index 5e1f19d..faabbb1 100644 --- a/MatCalcitePlugin/pom.xml +++ b/MatCalcitePlugin/pom.xml @@ -18,47 +18,38 @@ net.minidev accessors-smart - 2.6.0 net.minidev json-smart - 2.6.0 org.apache.calcite calcite-core - 1.41.0 org.apache.commons commons-dbcp2 - 2.14.0 com.google.guava guava - 33.7.2-jre com.google.code.findbugs jsr305 - 3.0.2 org.apache.geronimo.specs geronimo-jta_1.1_spec - 1.1.1 org.codehaus.janino commons-compiler - 3.1.12 org.codehaus.janino janino - 3.1.12 diff --git a/MatCalciteTargetPlatform/MatCalciteTargetPlatform.target b/MatCalciteTargetPlatform/MatCalciteTargetPlatform.target index 984fdb4..2af2fdc 100644 --- a/MatCalciteTargetPlatform/MatCalciteTargetPlatform.target +++ b/MatCalciteTargetPlatform/MatCalciteTargetPlatform.target @@ -13,28 +13,44 @@ net.minidev accessors-smart - 2.5.0 + 2.6.0 net.minidev json-smart - 2.5.0 + 2.6.0 org.apache.calcite calcite-core 1.36.0 + + + org.apache.calcite.avatica + avatica-core + 1.29.0 + com.google.guava guava - 32.1.3-jre + 33.7.2-jre com.google.code.findbugs jsr305 3.0.2 + + org.codehaus.janino + commons-compiler + 3.1.12 + + + org.codehaus.janino + janino + 3.1.12 + MatCalciteRepository + + + + + net.minidev + accessors-smart + 2.6.0 + + + net.minidev + json-smart + 2.6.0 + + + org.apache.calcite + calcite-core + 1.36.0 + + + + org.apache.calcite.avatica + avatica-core + 1.29.0 + + + org.apache.commons + commons-dbcp2 + 2.14.0 + + + com.google.guava + guava + 33.7.2-jre + + + com.google.code.findbugs + jsr305 + 3.0.2 + + + org.apache.geronimo.specs + geronimo-jta_1.1_spec + 1.1.1 + + + org.codehaus.janino + commons-compiler + 3.1.12 + + + org.codehaus.janino + janino + 3.1.12 + + + + Eclipse diff --git a/renovate.json b/renovate.json index 105ca1b..4ab639a 100644 --- a/renovate.json +++ b/renovate.json @@ -7,9 +7,22 @@ "prConcurrentLimit": 10, "prHourlyLimit": 5, "platformAutomerge": true, + "customManagers": [ + { + "description": "Maven dependencies in Tycho target definitions. The branch name comes from depName, so an update lands in the same PR as the one for the pom.", + "customType": "regex", + "managerFilePatterns": ["/\\.target$/"], + "matchStrings": [ + "(?[^<]+)\\s*(?[^<]+)\\s*(?[^<]+)" + ], + "depNameTemplate": "{{{groupId}}}:{{{artifactId}}}", + "datasourceTemplate": "maven", + "versioningTemplate": "maven" + } + ], "packageRules": [ { - "matchPackagePrefixes": ["org.codehaus.janino"], + "matchPackageNames": ["org.codehaus.janino:**"], "groupName": "org.codehaus.janino" }, {