chore(deps): Remove EOL kotlin-stdlib-jdk8 1.9.25 dependency, superseded by kotlin-stdlib transitively via okhttp-jvm - #28504
Open
NivinCS wants to merge 1 commit into
Conversation
…ded by kotlin-stdlib transitively via okhttp-jvm
NivinCS
marked this pull request as ready for review
September 17, 2026 17:02
prestodb-ci
requested review from
a team,
bibith4 and
infvg
and removed request for
a team
September 17, 2026 17:02
imjalpreet
reviewed
Sep 17, 2026
imjalpreet
left a comment
Member
There was a problem hiding this comment.
Thanks for the fix, @NivinCS.
A few suggestions:
- Please attach the before/after dependency:tree output in the Test Plan section.
- I think we should have a release note for this change under the security/dependency section.
- PR title is too long. Let's update it to:
chore(deps): Remove EOL kotlin-stdlib-jdk8 dependencyand move the rest to the PR body. - Is there a GitHub issue or a scanner finding (Dependabot/OpenSSF/CVE report) that motivated this? If yes, we could use that in the release note.
| @@ -179,7 +173,6 @@ | |||
| <ignoredUnusedDeclaredDependencies> | |||
| <!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp and Kotlin dependencies. --> | |||
Member
There was a problem hiding this comment.
nit:
Suggested change
| <!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp and Kotlin dependencies. --> | |
| <!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp dependencies. --> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Removes the explicit kotlin-stdlib-jdk8 1.9.25 dependency declaration from the project. This artifact reached End-of-Life on May 21, 2024 and is no longer needed.
Motivation and Context
The kotlin-stdlib-jdk8 pin was originally added to resolve a version conflict between okhttp-jvm and okio-jvm when okio-jvm was at version 3.9.1, which required kotlin-stdlib 1.9.25. The comment in the pom reflected this intent:
<!-- pull up to the version used in okio-jvm to avoid conflict with okhttp-* -->Since then, both okio-jvm and okhttp-jvm were upgraded to builds (3.16.4 and 5.3.2 respectively). Both of these versions now declare kotlin-stdlib 2.2.x (not kotlin-stdlib-jdk8) as their dependency. The explicit kotlin-stdlib-jdk8 1.9.25 pin was never updated and was actively downgrading the Kotlin stdlib to an EOL version.
Impact
Test Plan
Contributor checklist
Release Notes
Please follow release notes guidelines and fill in the release notes below.