From 30e5942079f7acfffc2e0aa18d8fcf041f1c2a5c Mon Sep 17 00:00:00 2001 From: Hongda Jiang Date: Tue, 20 Oct 2026 00:57:03 +0000 Subject: [PATCH 1/5] build: replace non-curatable dependencies and align profiles for Airlock --- google-auth-library-java/pom.xml | 46 ++++++++++++------- java-cloud-bom/dashboard/pom.xml | 20 ++++++++ java-cloud-bom/libraries-release-data/pom.xml | 14 ++++++ java-cloud-bom/pom.xml | 16 ++++++- .../release-note-generation/pom.xml | 13 ++++++ java-cloud-bom/tests/pom.xml | 14 ++++++ java-cloud-bom/tests/validate-bom/pom.xml | 13 ++++++ java-samples/native-image-sample/pom.xml | 2 +- java-spanner/samples/snippets/pom.xml | 2 +- .../dependency-convergence-check/pom.xml | 14 ++++++ .../unmanaged-dependency-check/pom.xml | 13 ++++++ 11 files changed, 148 insertions(+), 19 deletions(-) diff --git a/google-auth-library-java/pom.xml b/google-auth-library-java/pom.xml index f0304fafe2cb..fee32fec8949 100644 --- a/google-auth-library-java/pom.xml +++ b/google-auth-library-java/pom.xml @@ -398,22 +398,6 @@ - - org.codehaus.mojo - clirr-maven-plugin - - clirr-ignored-differences.xml - - true - - - - - check - - - - org.apache.maven.plugins maven-resources-plugin @@ -437,6 +421,36 @@ + + + clirr-compatibility-check + + [1.8,) + + + + + org.codehaus.mojo + clirr-maven-plugin + + clirr-ignored-differences.xml + + true + + + + + check + + + + + + + slf4j2x-test diff --git a/java-cloud-bom/dashboard/pom.xml b/java-cloud-bom/dashboard/pom.xml index 0e206f678a32..b56a6f639c52 100644 --- a/java-cloud-bom/dashboard/pom.xml +++ b/java-cloud-bom/dashboard/pom.xml @@ -119,6 +119,19 @@ com.google.cloud.tools dependencies 1.5.15 + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 com.google.code.findbugs @@ -134,6 +147,13 @@ + + + org.apache.maven.plugins + maven-surefire-plugin + 3.5.3 + org.codehaus.mojo exec-maven-plugin diff --git a/java-cloud-bom/libraries-release-data/pom.xml b/java-cloud-bom/libraries-release-data/pom.xml index 5ddae262c044..4babe4d78deb 100644 --- a/java-cloud-bom/libraries-release-data/pom.xml +++ b/java-cloud-bom/libraries-release-data/pom.xml @@ -15,6 +15,20 @@ dependencies 1.5.15 compile + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 + compile org.apache.maven.resolver diff --git a/java-cloud-bom/pom.xml b/java-cloud-bom/pom.xml index 35df7633e2ea..53d38d6b7928 100644 --- a/java-cloud-bom/pom.xml +++ b/java-cloud-bom/pom.xml @@ -44,11 +44,25 @@ release-note-generation libraries-release-data tests - tests/dependency-convergence + tests/validate-bom + + + + + org.apache.maven.plugins + maven-surefire-plugin + 3.5.3 + + + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 junit diff --git a/java-cloud-bom/tests/pom.xml b/java-cloud-bom/tests/pom.xml index 892ee470951f..30a6cf4ba3fa 100644 --- a/java-cloud-bom/tests/pom.xml +++ b/java-cloud-bom/tests/pom.xml @@ -56,6 +56,20 @@ dependencies 1.5.15 test + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 + test com.google.truth diff --git a/java-cloud-bom/tests/validate-bom/pom.xml b/java-cloud-bom/tests/validate-bom/pom.xml index 0c754db9b369..e269ae7ecab9 100644 --- a/java-cloud-bom/tests/validate-bom/pom.xml +++ b/java-cloud-bom/tests/validate-bom/pom.xml @@ -59,6 +59,19 @@ com.google.cloud.tools dependencies 1.5.15 + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 org.apache.maven.resolver diff --git a/java-samples/native-image-sample/pom.xml b/java-samples/native-image-sample/pom.xml index 3d95df2172cb..2f5c57ad02dc 100644 --- a/java-samples/native-image-sample/pom.xml +++ b/java-samples/native-image-sample/pom.xml @@ -18,7 +18,7 @@ com.google.cloud libraries-bom - 26.86.0 + 26.90.0 pom import diff --git a/java-spanner/samples/snippets/pom.xml b/java-spanner/samples/snippets/pom.xml index 4f41d624282d..256289809bf3 100644 --- a/java-spanner/samples/snippets/pom.xml +++ b/java-spanner/samples/snippets/pom.xml @@ -34,7 +34,7 @@ com.google.cloud libraries-bom - 26.80.0 + 26.90.0 pom import diff --git a/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml b/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml index 9db4c6b70921..08cb7b1e2dc5 100644 --- a/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml +++ b/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml @@ -39,6 +39,20 @@ dependencies 1.5.13 test + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 + test junit diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml index 67fe64419bdb..a5630e143c20 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml @@ -73,6 +73,19 @@ com.google.cloud.tools dependencies 1.5.13 + + + + isorelax + isorelax + + + + + org.netbeans.external + isorelax + RELEASE310 junit From df950d75953b000451e9043247ede66a71cf80d3 Mon Sep 17 00:00:00 2001 From: Hongda Jiang Date: Tue, 20 Oct 2026 01:46:35 +0000 Subject: [PATCH 2/5] build: ignore the isorelax replacement in dependency:analyze org.netbeans.external:isorelax replaces isorelax:isorelax as a runtime dependency of com.google.cloud.tools:dependencies. No code in the java-cloud-bom tooling modules uses it directly, so .kokoro/dependencies.sh (dependency:analyze -DfailOnWarning=true) reports it as an unused declared dependency. Add it to ignoredUnusedDeclaredDependencies in the 5 analyzed modules. --- java-cloud-bom/dashboard/pom.xml | 12 ++++++++++++ java-cloud-bom/libraries-release-data/pom.xml | 12 ++++++++++++ java-cloud-bom/release-note-generation/pom.xml | 12 ++++++++++++ java-cloud-bom/tests/pom.xml | 12 ++++++++++++ java-cloud-bom/tests/validate-bom/pom.xml | 12 ++++++++++++ 5 files changed, 60 insertions(+) diff --git a/java-cloud-bom/dashboard/pom.xml b/java-cloud-bom/dashboard/pom.xml index b56a6f639c52..8fc617cc9558 100644 --- a/java-cloud-bom/dashboard/pom.xml +++ b/java-cloud-bom/dashboard/pom.xml @@ -147,6 +147,18 @@ + + + org.apache.maven.plugins + maven-dependency-plugin + + + org.netbeans.external:isorelax + + + diff --git a/java-cloud-bom/libraries-release-data/pom.xml b/java-cloud-bom/libraries-release-data/pom.xml index 4babe4d78deb..20e9e8ffd762 100644 --- a/java-cloud-bom/libraries-release-data/pom.xml +++ b/java-cloud-bom/libraries-release-data/pom.xml @@ -51,6 +51,18 @@ + + + org.apache.maven.plugins + maven-dependency-plugin + + + org.netbeans.external:isorelax + + + org.codehaus.mojo exec-maven-plugin diff --git a/java-cloud-bom/release-note-generation/pom.xml b/java-cloud-bom/release-note-generation/pom.xml index e470c06d77cf..977e0d6a07dc 100644 --- a/java-cloud-bom/release-note-generation/pom.xml +++ b/java-cloud-bom/release-note-generation/pom.xml @@ -66,6 +66,18 @@ + + + org.apache.maven.plugins + maven-dependency-plugin + + + org.netbeans.external:isorelax + + + org.codehaus.mojo exec-maven-plugin diff --git a/java-cloud-bom/tests/pom.xml b/java-cloud-bom/tests/pom.xml index 30a6cf4ba3fa..b2b6665f968f 100644 --- a/java-cloud-bom/tests/pom.xml +++ b/java-cloud-bom/tests/pom.xml @@ -100,6 +100,18 @@ + + + org.apache.maven.plugins + maven-dependency-plugin + + + org.netbeans.external:isorelax + + + org.apache.maven.plugins maven-surefire-plugin diff --git a/java-cloud-bom/tests/validate-bom/pom.xml b/java-cloud-bom/tests/validate-bom/pom.xml index e269ae7ecab9..d0668968e701 100644 --- a/java-cloud-bom/tests/validate-bom/pom.xml +++ b/java-cloud-bom/tests/validate-bom/pom.xml @@ -86,6 +86,18 @@ + + + org.apache.maven.plugins + maven-dependency-plugin + + + org.netbeans.external:isorelax + + + org.codehaus.mojo exec-maven-plugin From dba880a8c5d8806d678436e5d265b4851784f92e Mon Sep 17 00:00:00 2001 From: Hongda Jiang Date: Thu, 22 Oct 2026 14:59:10 +0000 Subject: [PATCH 3/5] build: bump com.google.cloud.tools:dependencies to 1.5.16 and remove local isorelax workarounds --- java-cloud-bom/dashboard/pom.xml | 36 ++----------------- java-cloud-bom/libraries-release-data/pom.xml | 28 +-------------- .../release-note-generation/pom.xml | 27 +------------- java-cloud-bom/tests/pom.xml | 28 +-------------- java-cloud-bom/tests/validate-bom/pom.xml | 27 +------------- .../dependency-convergence-check/pom.xml | 16 +-------- .../unmanaged-dependency-check/pom.xml | 15 +------- 7 files changed, 8 insertions(+), 169 deletions(-) diff --git a/java-cloud-bom/dashboard/pom.xml b/java-cloud-bom/dashboard/pom.xml index 8fc617cc9558..b4e3ff242dcb 100644 --- a/java-cloud-bom/dashboard/pom.xml +++ b/java-cloud-bom/dashboard/pom.xml @@ -6,7 +6,7 @@ com.google.cloud.tools dependencies-parent - 1.5.15 + 1.5.16 google-cloud-bom-dashboard @@ -118,20 +118,7 @@ com.google.cloud.tools dependencies - 1.5.15 - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 + 1.5.16 com.google.code.findbugs @@ -147,25 +134,6 @@ - - - org.apache.maven.plugins - maven-dependency-plugin - - - org.netbeans.external:isorelax - - - - - - org.apache.maven.plugins - maven-surefire-plugin - 3.5.3 - org.codehaus.mojo exec-maven-plugin diff --git a/java-cloud-bom/libraries-release-data/pom.xml b/java-cloud-bom/libraries-release-data/pom.xml index 20e9e8ffd762..3c62cbc83e19 100644 --- a/java-cloud-bom/libraries-release-data/pom.xml +++ b/java-cloud-bom/libraries-release-data/pom.xml @@ -13,22 +13,8 @@ com.google.cloud.tools dependencies - 1.5.15 + 1.5.16 compile - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 - compile org.apache.maven.resolver @@ -51,18 +37,6 @@ - - - org.apache.maven.plugins - maven-dependency-plugin - - - org.netbeans.external:isorelax - - - org.codehaus.mojo exec-maven-plugin diff --git a/java-cloud-bom/release-note-generation/pom.xml b/java-cloud-bom/release-note-generation/pom.xml index 977e0d6a07dc..f70316b51c65 100644 --- a/java-cloud-bom/release-note-generation/pom.xml +++ b/java-cloud-bom/release-note-generation/pom.xml @@ -25,20 +25,7 @@ com.google.cloud.tools dependencies - 1.5.15 - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 + 1.5.16 junit @@ -66,18 +53,6 @@ - - - org.apache.maven.plugins - maven-dependency-plugin - - - org.netbeans.external:isorelax - - - org.codehaus.mojo exec-maven-plugin diff --git a/java-cloud-bom/tests/pom.xml b/java-cloud-bom/tests/pom.xml index b2b6665f968f..13de77761f08 100644 --- a/java-cloud-bom/tests/pom.xml +++ b/java-cloud-bom/tests/pom.xml @@ -54,21 +54,7 @@ com.google.cloud.tools dependencies - 1.5.15 - test - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 + 1.5.16 test @@ -100,18 +86,6 @@ - - - org.apache.maven.plugins - maven-dependency-plugin - - - org.netbeans.external:isorelax - - - org.apache.maven.plugins maven-surefire-plugin diff --git a/java-cloud-bom/tests/validate-bom/pom.xml b/java-cloud-bom/tests/validate-bom/pom.xml index d0668968e701..b44c3f1c6dab 100644 --- a/java-cloud-bom/tests/validate-bom/pom.xml +++ b/java-cloud-bom/tests/validate-bom/pom.xml @@ -58,20 +58,7 @@ com.google.cloud.tools dependencies - 1.5.15 - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 + 1.5.16 org.apache.maven.resolver @@ -86,18 +73,6 @@ - - - org.apache.maven.plugins - maven-dependency-plugin - - - org.netbeans.external:isorelax - - - org.codehaus.mojo exec-maven-plugin diff --git a/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml b/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml index 08cb7b1e2dc5..c95cae435f0f 100644 --- a/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml +++ b/sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml @@ -37,21 +37,7 @@ com.google.cloud.tools dependencies - 1.5.13 - test - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 + 1.5.16 test diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml index a5630e143c20..414256519cd6 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/pom.xml @@ -72,20 +72,7 @@ com.google.cloud.tools dependencies - 1.5.13 - - - - isorelax - isorelax - - - - - org.netbeans.external - isorelax - RELEASE310 + 1.5.16 junit From 64e86738de5c77df0be0fba693046a44f93aaae5 Mon Sep 17 00:00:00 2001 From: Hongda Jiang Date: Thu, 22 Oct 2026 20:36:48 +0000 Subject: [PATCH 4/5] fix(shared-dependencies): skip google-cloud-logging-logback in UnmanagedDependencyCheck --- .../com/google/cloud/UnmanagedDependencyCheck.java | 12 +++++++++++- .../google/cloud/UnmanagedDependencyCheckTest.java | 2 +- .../google-internal-artifact-test-case-pom.xml | 5 +++++ 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java index 832745b346ec..b47c4934bca9 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java @@ -6,6 +6,7 @@ import com.google.cloud.tools.opensource.classpath.DependencyMediation; import com.google.cloud.tools.opensource.dependencies.Bom; import com.google.cloud.tools.opensource.dependencies.MavenRepositoryException; +import com.google.common.collect.ImmutableSet; import java.nio.file.Paths; import java.util.HashSet; import java.util.List; @@ -18,6 +19,11 @@ * A utility class to check unmanaged dependencies in BOM. */ public class UnmanagedDependencyCheck { + // Artifacts listed in gapic-libraries-bom whose third-party dependencies (e.g. logback) + // are intentionally not managed by google-cloud-shared-dependencies. + private static final ImmutableSet BOM_SKIP_ARTIFACT_IDS = + ImmutableSet.of("google-cloud-logging-logback", "google-cloud-contrib"); + // Regex of handwritten artifacts. // There are customized artifacts defined in gapic-bom and handwritten libraries, // e.g., firestore and datastore, add entries in regex to exclude these artifacts. @@ -73,8 +79,12 @@ private static Set getManagedDependencies(String projectBomPath) private static Set getManagedDependenciesFromBom(Bom bom) throws InvalidVersionSpecificationException { Set res = new HashSet<>(); + List managedDependencies = + bom.getManagedDependencies().stream() + .filter(artifact -> !BOM_SKIP_ARTIFACT_IDS.contains(artifact.getArtifactId())) + .collect(Collectors.toList()); new ClassPathBuilder() - .resolve(bom.getManagedDependencies(), false, DependencyMediation.MAVEN) + .resolve(managedDependencies, false, DependencyMediation.MAVEN) .getClassPath() .forEach( classPath -> { diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java index 384db40e0b83..82fe8a21011b 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java @@ -26,7 +26,7 @@ public void getUnmanagedDependencyFromGapicAndHandwrittenBomTest() UnmanagedDependencyCheck.getUnmanagedDependencies( "src/test/resources/shared-dependency-pom.xml", "src/test/resources/google-internal-artifact-test-case-pom.xml"); - assertTrue(unManagedDependencies.isEmpty()); + assertThat(unManagedDependencies).isEmpty(); } @Test diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/resources/google-internal-artifact-test-case-pom.xml b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/resources/google-internal-artifact-test-case-pom.xml index f5342f5ee040..386c1ae96b00 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/resources/google-internal-artifact-test-case-pom.xml +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/resources/google-internal-artifact-test-case-pom.xml @@ -62,6 +62,11 @@ import pom + + com.google.cloud + google-cloud-logging-logback + 0.132.0-alpha + From 4d3afe0d94b1ff9b5d06889788fb5996a14cfeb6 Mon Sep 17 00:00:00 2001 From: Hongda Jiang Date: Thu, 22 Oct 2026 21:10:21 +0000 Subject: [PATCH 5/5] chore(shared-dependencies): add license headers to UnmanagedDependencyCheck sources --- .../google/cloud/UnmanagedDependencyCheck.java | 16 ++++++++++++++++ .../cloud/UnmanagedDependencyCheckTest.java | 16 ++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java index b47c4934bca9..a955c4fbac93 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/main/java/com/google/cloud/UnmanagedDependencyCheck.java @@ -1,3 +1,19 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + package com.google.cloud; import static com.google.common.base.Preconditions.checkArgument; diff --git a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java index 82fe8a21011b..fe71a45271d2 100644 --- a/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java +++ b/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check/src/test/java/com/google/cloud/UnmanagedDependencyCheckTest.java @@ -1,3 +1,19 @@ +/* + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + package com.google.cloud; import static com.google.common.truth.Truth.assertThat;