Skip to content

chore(deps): Remove EOL kotlin-stdlib-jdk8 1.9.25 dependency, superseded by kotlin-stdlib transitively via okhttp-jvm - #28504

Open
NivinCS wants to merge 1 commit into
prestodb:masterfrom
NivinCS:remove-kotlin-stdlib-jdk8-eol-dependency
Open

NivinCS wants to merge 1 commit into
prestodb:masterfrom
NivinCS:remove-kotlin-stdlib-jdk8-eol-dependency

Conversation

@NivinCS

@NivinCS NivinCS commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

Description

Removes the explicit kotlin-stdlib-jdk8 1.9.25 dependency declaration from the project. This artifact reached End-of-Life on May 21, 2024 and is no longer needed.

Motivation and Context

The kotlin-stdlib-jdk8 pin was originally added to resolve a version conflict between okhttp-jvm and okio-jvm when okio-jvm was at version 3.9.1, which required kotlin-stdlib 1.9.25. The comment in the pom reflected this intent:

<!-- pull up to the version used in okio-jvm to avoid conflict with okhttp-* -->

Since then, both okio-jvm and okhttp-jvm were upgraded to builds (3.16.4 and 5.3.2 respectively). Both of these versions now declare kotlin-stdlib 2.2.x (not kotlin-stdlib-jdk8) as their dependency. The explicit kotlin-stdlib-jdk8 1.9.25 pin was never updated and was actively downgrading the Kotlin stdlib to an EOL version.

Impact

Test Plan

Contributor checklist

  • Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.
  • If adding new dependencies, verified they have an OpenSSF Scorecard score of 5.0 or higher (or obtained explicit TSC approval for lower scores).

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== NO RELEASE NOTE ==

…ded by kotlin-stdlib transitively via okhttp-jvm
@prestodb-ci prestodb-ci added the from:IBM PR from IBM label Sep 17, 2026
@NivinCS
NivinCS marked this pull request as ready for review September 17, 2026 17:02
@NivinCS
NivinCS requested a review from a team as a code owner September 17, 2026 17:02
@prestodb-ci
prestodb-ci requested review from a team, bibith4 and infvg and removed request for a team September 17, 2026 17:02

@imjalpreet imjalpreet left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix, @NivinCS.

A few suggestions:

  • Please attach the before/after dependency:tree output in the Test Plan section.
  • I think we should have a release note for this change under the security/dependency section.
  • PR title is too long. Let's update it to: chore(deps): Remove EOL kotlin-stdlib-jdk8 dependency and move the rest to the PR body.
  • Is there a GitHub issue or a scanner finding (Dependabot/OpenSSF/CVE report) that motivated this? If yes, we could use that in the release note.

Comment thread presto-client/pom.xml
@@ -179,7 +173,6 @@
<ignoredUnusedDeclaredDependencies>
<!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp and Kotlin dependencies. -->

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit:

Suggested change
<!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp and Kotlin dependencies. -->
<!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp dependencies. -->

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

from:IBM PR from IBM

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants