[HBASE-18680] Document things to consider / document when changing dependencies

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: community, documentation
• Assignee: Unassigned
• Reporter: Sean Busbey
• Created: 25/Aug/17 00:25
• Updated: 29/Aug/17 14:06

Description

While reviewing HBASE-18674 ("upgrade hbase to commons-lang 3"), I realized that my questions are the same as I'd give for any dependency change. We should try to update our docs to proactively push folks on checking whenever a dependency changes (paraphrased):

1. What's the license of the direct dependency overall?
2. Does it contain parts that are under a different license (esp if the overall is ALv2)?
3. If it is ALv2 does it contain a NOTICE file? If so, do we need to update our NOTICE file based on it?
4. Does it change the set of transitive dependencies? If so, apply the same questions above to that set of changes.