HBASE-29807 Depend on jcip-annotations explicitly

[xavifeds8]

Issue : HBase build fails with latest Hadoop versions due to missing net.jcip.annotations package.
Earlier hadoop was dependent on com.nimbusds:nimbus-jose-jwt:jar:9.37.2 (which brought in com.github.stephenc.jcip:jcip-annotations:jar:1.0-1).

With latest hadoop: it has moved to com.nimbusds:nimbus-jose-jwt:jar:10.0.2 (which does not bring in the dependency), refer commit apache/hadoop@3baa288#diff-635a9ebcc70f58d8ca1c55b0d78cc90064a5081d189162a432271778da3cf018.

[Copilot]

Pull request overview

This PR adds the jcip-annotations dependency to HBase to maintain compatibility with Hadoop 3.4+, where the dependency is no longer transitively provided through nimbus-jose-jwt.

Key Changes:

• Added jcip-annotations to the root pom's dependencyManagement section
• Added jcip-annotations as a compile-scoped optional dependency to hbase-client module

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pom.xml	Adds jcip-annotations to dependencyManagement with version 1.0-1 using groupId com.github.stephenc.jcip
hbase-client/pom.xml	Declares jcip-annotations as a compile-scoped optional dependency for the hbase-client module where it's used

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Apache-HBase]

🎊 +1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 50s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
			_ master Compile Tests _
+0 🆗	mvndep	0m 28s		Maven dependency ordering for branch
+1 💚	mvninstall	4m 40s		master passed
+1 💚	compile	13m 52s		master passed
+1 💚	spotless	1m 17s		branch has no errors when running spotless:check.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 23s		Maven dependency ordering for patch
+1 💚	mvninstall	4m 48s		the patch passed
+1 💚	compile	13m 22s		the patch passed
+1 💚	javac	13m 22s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	xmllint	0m 1s		No new issues.
+1 💚	hadoopcheck	16m 48s		Patch does not cause any errors with Hadoop 3.3.6 3.4.1.
+1 💚	spotless	1m 13s		patch has no errors when running spotless:check.
			_ Other Tests _
+1 💚	asflicense	0m 27s		The patch does not generate ASF License warnings.
		68m 6s

Subsystem	Report/Notes
Docker	ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7592/3/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	#7592
Optional Tests	dupname asflicense javac codespell detsecrets xmllint hadoopcheck spotless compile
uname	Linux fe6486b418e1 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 7d5a9e3
Default Java	Eclipse Adoptium-17.0.11+9
Max. process+thread count	187 (vs. ulimit of 30000)
modules	C: hbase-client . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7592/3/console
versions	git=2.34.1 maven=3.9.8 xmllint=20913
Powered by	Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

[Apache-HBase]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 12s		Docker mode activated.
-0 ⚠️	yetus	0m 3s		Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --author-ignore-list --blanks-eol-ignore-file --blanks-tabs-ignore-file --quick-hadoopcheck
			_ Prechecks _
			_ master Compile Tests _
+0 🆗	mvndep	0m 24s		Maven dependency ordering for branch
+1 💚	mvninstall	3m 34s		master passed
+1 💚	compile	2m 22s		master passed
+1 💚	javadoc	2m 40s		master passed
+1 💚	shadedjars	5m 20s		branch has no errors when building our shaded downstream artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 14s		Maven dependency ordering for patch
+1 💚	mvninstall	2m 19s		the patch passed
+1 💚	compile	1m 40s		the patch passed
+1 💚	javac	1m 40s		the patch passed
+1 💚	javadoc	1m 42s		the patch passed
+1 💚	shadedjars	4m 31s		patch has no errors when building our shaded downstream artifacts.
			_ Other Tests _
-1 ❌	unit	265m 22s	/patch-unit-root.txt	root in the patch failed.
		296m 14s

Subsystem	Report/Notes
Docker	ClientAPI=1.48 ServerAPI=1.48 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7592/3/artifact/yetus-jdk17-hadoop3-check/output/Dockerfile
GITHUB PR	#7592
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux d16a61eabf36 6.8.0-1024-aws #26~22.04.1-Ubuntu SMP Wed Feb 19 06:54:57 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 7d5a9e3
Default Java	Eclipse Adoptium-17.0.11+9
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7592/3/testReport/
Max. process+thread count	5247 (vs. ulimit of 30000)
modules	C: hbase-client . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-7592/3/console
versions	git=2.34.1 maven=3.9.8
Powered by	Apache Yetus 0.15.0 https://yetus.apache.org

This message was automatically generated.

[xavifeds8]

@Apache9 Since Hadoop has moved to com.nimbusds:nimbus-jose-jwt:jar:10.0.2 (which no longer brings jcip-annotations as a transitive dependency), Hadoop now explicitly depends on com.github.stephenc.jcip to provide jcip-annotations.
However, in HBase, we currently have net.jcip specified in the supplemental-models.xml file, which also brings in jcip-annotations.
Should we align with Hadoop and move to com.github.stephenc.jcip, or should we continue using net.jcip?

[Apache9]

@Apache9 Since Hadoop has moved to com.nimbusds:nimbus-jose-jwt:jar:10.0.2 (which no longer brings jcip-annotations as a transitive dependency), Hadoop now explicitly depends on com.github.stephenc.jcip to provide jcip-annotations. However, in HBase, we currently have net.jcip specified in the supplemental-models.xml file, which also brings in jcip-annotations. Should we align with Hadoop and move to com.github.stephenc.jcip, or should we continue using net.jcip?

The supplemental-models.xml file does not introduce dependencies, we use this file to tell some checks in the release stage(I can not recall the name) that these dependencies have incorrect license information but their licenses are compatibible.

So if we do not need to depend on some libraries any more, we could just remove the related section in supplemental-models.xml, and there is also no problem to leave it as is.

Since hadoop now depends on com.github.stephenc.jcip directly, why do we not pull the dependency in?

[Apache9]

I mean why we need to add it in our pom explicitly? We can not pull it in automatically when depending on hadoop? Hadoop also declares it as an optional dependency?

[xavifeds8]

I mean why we need to add it in our pom explicitly? We can not pull it in automatically when depending on hadoop? Hadoop also declares it as an optional dependency?

I was thinking it would be much safer if we declare it ourself so in the future If Hadoop later marks it optional or removes it. Hbase wont be affected. Since we directly use them in some classes, seems safer to just declare it ourselves rather than hoping it stays available transitively.
Adding to this, Hadoop adds the jcip dependency in the test scope. Hence we wont be getting that depedency transitively. hence the explicit depedency would be necessary.
What do you think? Any concerns with this approach?