+1
If we conclude that nobody, or almost nobody, is using it, and keeping it is creating unnecessary resistance to other important initiatives, I’m fine with removing it in 4.3 as well—although that would be quite an aggressive move
-Ayush Totally agree with Sai's points. I also agree to depricate this module.
-Attila Hello team,
I support deprecating druid-handler and targeting removal in a future major release.
I worked on HIVE-29707 (upgrade Druid 0.17.1 --> 26.0.0) to address CVE exposure from the 2020-era dependency. The handler itself can be made to compile, but keeping it current is costly and the blast radius is wide:
1) Large API drift across storage handler, indexing, serde, and Kafka supervisor classes
2) hive-it-druid (~200 MB shaded jar) is pulled into unrelated qfile drivers (e.g. TestMiniLlapCliDriver), causing collateral test failures
3) Ongoing shading conflicts with Hive's stack (Calcite/Jackson/Guava), consistent with the CALCITE-6393 issues mentioned above
Combined with minimal recent development and no clear maintainer/user base, I'd deprecate in docs/build now and remove in the next major. I wouldn't invest in a full upgrade unless someone commits to long-term ownership.
Happy to share HIVE-29707 details if useful for a formal deprecation proposal.
On 2026/07/15 11:38:13 Ruben Q L wrote:
> Hello!
>
> In the context of a WIP Calcite upgrade [1] I ran into shading issues in
> druid-handler (an ASM failure when relocating Calcite's SqlFunctions.class,
> tracked upstream in CALCITE-6393). I worked around it by dropping the
> Calcite relocation in druid-handler/pom.xml, but it prompted me to re-open
> an earlier discussion [2] about whether we should still be carrying this
> module at all.
>
> Nothing seems to have changed since it was last raised: we're still on
> Druid 0.17.1 [3] (released in 2020), which has a number of unpatched CVEs
> [4], and there's been essentially no meaningful development in the module
> [5].
>
> So the same questions remain open:
> - Are there any active users of druid-handler?
> - If there are users but no maintainers, should we deprecate the module
> (docs + build) and target removal in a future major release?
> - If there are neither, shall we drop it now?
>
> Best,
> Ruben
>
> [1] https://issues.apache.org/jira/browse/HIVE-29641
> [2] https://lists.apache.org/thread/1swonwzts4rztz0vdjhllbzmotsdx8ro
> [3]
> https://github.com/apache/hive/blob/c4791205d84201b351a8353e9eacadbc3c972c3e/pom.xml#L137
> [4] https://mvnrepository.com/artifact/org.apache.druid/druid/0.17.1
> [5]
> https://github.com/search?q=repo%3Aapache%2Fhive+druid&type=commits&s=committer-date&o=desc
>
|
