Skip to content

Revert "[Sandbox SQL snapshot] Pin org.opensearch.query:* (unified-query-*) snapshots to mavenLocal"#21579

Closed
mch2 wants to merge 1 commit intomainfrom
revert-21578-fix-mavenlocal-pin-unified-query
Closed

Revert "[Sandbox SQL snapshot] Pin org.opensearch.query:* (unified-query-*) snapshots to mavenLocal"#21579
mch2 wants to merge 1 commit intomainfrom
revert-21578-fix-mavenlocal-pin-unified-query

Conversation

@mch2
Copy link
Copy Markdown
Member

@mch2 mch2 commented May 9, 2026

Reverts #21578 - this is breaking snapshot publish workflow.

@mch2 mch2 requested a review from a team as a code owner May 9, 2026 18:31
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 9, 2026

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit e6fff15.

PathLineSeverityDescription
sandbox/plugins/test-ppl-frontend/build.gradle35highUnrestricted `mavenLocal()` added as a dependency repository. The previous configuration scoped mavenLocal strictly to `org.opensearch.query` via `includeGroup`. The new form resolves ALL dependencies from the local Maven cache first, enabling any locally-cached artifact to shadow remote ones — a classic dependency confusion/supply chain injection vector in CI environments.
sandbox/plugins/analytics-engine/build.gradle17highDependency version downgraded from `3.7.0.0-SNAPSHOT` to `3.6.0.0-SNAPSHOT` for `org.opensearch.query:unified-query-api`. SNAPSHOT version downgrades are a dependency change and must be flagged; maintainers should verify the older SNAPSHOT artifact resolves to the intended content.
sandbox/build.gradle49highRemoval of the subproject-wide `mavenLocal { mavenContent { includeGroup 'org.opensearch.query' } }` repository block. This changes dependency resolution strategy for all sandbox subprojects, eliminating the group-scoped restriction that prevented mavenLocal from serving unintended artifacts to the broader build.
sandbox/plugins/analytics-backend-datafusion/build.gradle18highRemoval of `mavenContent { excludeGroup 'org.opensearch.query' }` from the OpenSearch Snapshots remote repository. This content filter previously blocked the remote from serving `org.opensearch.query:*` artifacts; its removal changes which repository wins resolution for that group — a dependency resolution configuration change that must be verified.

The table above displays the top 10 most important findings.

Total: 4 | Critical: 0 | High: 4 | Medium: 0 | Low: 0


Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.


⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

@mch2 mch2 closed this May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants