[BUILD] Drop oro dependency #57209

Activity

1. gaogaotiantian commented on Jul 13, 2026

   

   gaogaotiantian

   on Jul 13, 2026

   Contributor

   More actions

   I think this probably makes sense. The project oro was retired 16 years ago - https://jakarta.apache.org/oro/ . The dependency was introduced 12 years ago as the optional dependency of ivy which should be fine without it. @dongjoon-hyun

   👀React with 👀1Reacted by Dongjoon Hyun
2. dongjoon-hyun commented on Jul 13, 2026

   

   dongjoon-hyun

   on Jul 13, 2026

   Member

   More actions

   May I ask why you ping me, @gaogaotiantian ?
3. gaogaotiantian commented on Jul 13, 2026

   

   gaogaotiantian

   on Jul 13, 2026

   Contributor

   More actions

   Oh you have been dealing with Java dependencies a lot. WDYT about this? Do you think it's okay for us to remove this very old and retired dependency?
4. dongjoon-hyun commented on Jul 13, 2026

   

   dongjoon-hyun

   on Jul 13, 2026

   Member

   More actions

   Got it. Thank you for pinging me, @gaogaotiantian . Most recent dependency cleanup work are related to the ASF License issues actually (and wrong security complaints).

   Oh you have been dealing with Java dependencies a lot.

   BTW, I'm on-call this week and have very limited bandwidth and I didn't have enough thought on that topic before. Sorry about that. Feel free to proceed this in your way because the community has many eyes.
5. gaogaotiantian commented on Jul 13, 2026

   

   gaogaotiantian

   on Jul 13, 2026

   Contributor

   More actions

   @dongjoon-hyun got it! Thanks for your input! I'll leave this issue open for discussion for a few days. If no one objects I (or the author of the issue) will create a PR and ask the community for review.

   👍React with 👍2Reacted by Dongjoon Hyun and art000109
6. art000109 commented on Jul 14, 2026

   

   art000109

   on Jul 14, 2026

   Last edited by art000109

   ContributorAuthor

   More actions

   @gaogaotiantian Thank you for your thoughts and support!
   I proposed removing the dependency because I saw that it had been removed in log4j2 [LOG4J2-283]. I wasn't aware of the situation regarding Ivy.
7. ybapat commented on Jul 24, 2026

   

   ybapat

   on Jul 24, 2026

   Contributor

   More actions

   I've opened a PR to address this: #57492

   The change removes:

   • The <oro.version>2.0.8</oro.version> property from the root pom.xml
   • The oro dependency block from common/utils/pom.xml
   • The oro/2.0.8//oro-2.0.8.jar entry from dev/deps/spark-deps-hadoop-3-hive-2.3
   • The oro:oro entry from LICENSE-binary

   As @gaogaotiantian noted, modern Ivy (2.5.x) works fine without it. No Spark source imports org.apache.oro.* directly.