PHOENIX-7944 maven-dependency-plugin analyze-only fails on hbase-2.6.0 profile due to bouncycastle jdk15on/jdk18on mismatch

[lokiore]

PHOENIX-7944

The 5.3.2RC1 publish-release build failed deterministically on the hbase-2.6.0 profile (3rd of 4: 2.5.0 2.5 2.6.0 2.6). maven-dependency-plugin:3.1.1:analyze-only (enforce-dependencies) on phoenix-core reports:

• Used undeclared: org.bouncycastle:bcprov-jdk15on:jar:1.68:test
• Unused declared: org.bouncycastle:bcprov-jdk18on:jar:1.79:test

Root cause

The 2.6.0 profile resolves HBase to 2.6.1-hadoop3 (hbase-2.6.0.runtime.version), whose test deps transitively pull the OLD bcprov-jdk15on:1.68, while phoenix-core declares the NEW bcprov-jdk18on:1.79. The 2.5.x profiles do not pull jdk15on, so they pass — which is why RC0 (no 2.6.0 profile) and the 5.2.2 release never hit this. Adding 2.6.0 to hbase.profile.list (#2550) exposed the pre-existing latent mismatch.

Fix

In the root pom maven-dependency-plugin config, ignore org.bouncycastle:bcprov-jdk18on as unused-declared and org.bouncycastle:bcprov-jdk15on as used-undeclared — mirroring the existing log4j / commons-configuration2 cross-profile handling.

🤖 Generated with Claude Code