[FLINK-19164] Release scripts break other dependency versions unintentionally

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.14.0
• Component/s: Deployment / Scripts, Release System
• Labels: auto-unassigned pull-request-available
• Assignee: Serhat Soydan
• Reporter: Serhat Soydan
• Created: 08/Sep/20 13:34
• Updated: 23/Sep/21 17:25
• Resolved: 09/Jun/21 10:21

Description

All the scripts below has a line to change the old version to new version in pom files.

https://github.com/apache/flink/blob/master/tools/change-version.sh#L31

https://github.com/apache/flink/blob/master/tools/releasing/create_release_branch.sh#L60

https://github.com/apache/flink/blob/master/tools/releasing/update_branch_version.sh#L52

 

It works like find & replace so it is prone to unintentional errors. Any dependency with a version equals to "old version" might be automatically changed to "new version". See below to see how to produce a similar case. 

 

How to re-produce the bug:

• Clone/Fork Flink repo and for example checkout version v*1.11.1* 
• Apply any changes you need
• Run "create_release_branch.sh" script with OLD_VERSION=1.11.1 NEW_VERSION=1.12.0
  • In parent pom.xml, an auto find&replace of maven-dependency-analyzer version will be done automatically and unintentionally which will break the build.

 
                        <dependency>
                            <groupId>org.apache.maven.shared</groupId>
                            <artifactId>maven-dependency-analyzer</artifactId>
                            <version>1.11.1</version>
                        </dependency>
 
                        <dependency>
                            <groupId>org.apache.maven.shared</groupId>
                            <artifactId>maven-dependency-analyzer</artifactId>
                            <version>1.12.0</version>
                        </dependency>

Issue Links

• links to: GitHub Pull Request #15835
• links to: GitHub Pull Request #15835