From 3d51036def35d953e8551658f252d29360a8fb92 Mon Sep 17 00:00:00 2001
From: Andreas Maechler <amaechler@gmail.com>
Date: Wed, 27 May 2026 16:58:28 -0600
Subject: [PATCH] Bump caffeine to 3.2.4 and errorprone to 2.49.0

Caffeine 3 raised the Java baseline to 11, tightened the AsyncCache
surface, and replaced size-LRU eviction with W-TinyLFU with explicit
admission control. The Caffeine APIs Druid uses (Cache, Caffeine
builder, Weigher, CacheStats) are stable across the transition.

Errorprone 2.49.0 is required because caffeine 3.2.4 pulls
error_prone_annotations 2.49.0 transitively, which violates the
requireUpperBoundDeps enforcer rule without the bump.

CaffeineCacheTest.testSizeEviction is rewritten for W-TinyLFU: the old
test pre-read key1 multiple times before putting key2, biasing the
admission policy to keep key1 and reject val2, so the assertion that
key1 was evicted no longer holds. The rewrite avoids the pre-reads
and asserts only that eviction happened and the cache stayed under
bound, mirroring caffeine's own EvictionTest patterns.

Also adds the previously-missing license entry for org.jspecify:jspecify
1.0.0 in extensions-core/kubernetes-extensions, which the
check-licenses dependency report flags. This was missing pre-bump and
is unrelated to caffeine/errorprone, but the CI license check fails
without it, so it is included here to keep the PR green.
---
 licenses.yaml                                 | 14 +++++++++--
 pom.xml                                       |  4 +--
 .../druid/client/cache/CaffeineCacheTest.java | 25 +++++++++----------
 3 files changed, 26 insertions(+), 17 deletions(-)

diff --git a/licenses.yaml b/licenses.yaml
index 23f58a0d3b3d..94d00f2dd8fe 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -424,7 +424,7 @@ name: Caffeine
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.9.3
+version: 3.2.4
 libraries:
   - com.github.ben-manes.caffeine: caffeine
 
@@ -434,7 +434,7 @@ name: Error Prone Annotations
 license_category: binary
 module: java-core
 license_name: Apache License version 2.0
-version: 2.41.0
+version: 2.49.0
 libraries:
   - com.google.errorprone: error_prone_annotations
 
@@ -1107,6 +1107,16 @@ libraries:
 
 ---
 
+name: org.jspecify jspecify
+license_category: binary
+module: extensions-core/kubernetes-extensions
+license_name: Apache License version 2.0
+version: 1.0.0
+libraries:
+  - org.jspecify: jspecify
+
+---
+
 name: io.gsonfire gson-fire
 license_category: binary
 module: extensions-core/kubernetes-extensions
diff --git a/pom.xml b/pom.xml
index aabb17d07f08..599e609fa8c3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -96,7 +96,7 @@
         <datasketches.memory.version>2.2.0</datasketches.memory.version>
         <derby.version>10.17.1.0</derby.version>
         <dropwizard.metrics.version>4.2.22</dropwizard.metrics.version>
-        <errorprone.version>2.41.0</errorprone.version>
+        <errorprone.version>2.49.0</errorprone.version>
         <fabric8.version>7.6.0</fabric8.version>
         <fastutil.version>8.5.4</fastutil.version>
         <guava.version>32.1.3-jre</guava.version>
@@ -125,7 +125,7 @@
              It should be removed once those extensions are upgraded or dropped (see #19109). -->
         <aws.sdk.v1.version>1.12.793</aws.sdk.v1.version>
         <aws.sdk.v2.version>2.40.0</aws.sdk.v2.version>
-        <caffeine.version>2.9.3</caffeine.version>
+        <caffeine.version>3.2.4</caffeine.version>
         <jacoco.version>0.8.14</jacoco.version>
         <testcontainers.version>2.0.3</testcontainers.version>
         <hibernate-validator.version>6.2.5.Final</hibernate-validator.version>
diff --git a/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java b/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java
index b34fcbdd830c..35cfc4ddf42a 100644
--- a/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java
+++ b/server/src/test/java/org/apache/druid/client/cache/CaffeineCacheTest.java
@@ -191,22 +191,21 @@ public long getSizeInBytes()
     final Cache.NamedKey key2 = new Cache.NamedKey("the", s2);
     final CaffeineCache cache = CaffeineCache.create(config, Runnable::run);
 
-    Assert.assertNull(cache.get(key1));
-    Assert.assertNull(cache.get(key2));
-
-    cache.put(key1, val1);
-    Assert.assertArrayEquals(val1, cache.get(key1));
-    Assert.assertNull(cache.get(key2));
-
     Assert.assertEquals(0, cache.getCache().stats().evictionWeight());
 
-    Assert.assertArrayEquals(val1, cache.get(key1));
-    Assert.assertNull(cache.get(key2));
-
+    // Two entries with combined weight exceeding the 40-byte maximum. Caffeine 3's W-TinyLFU
+    // admission policy chooses which to keep based on frequency; we don't assert on identity,
+    // only that eviction happened and the cache shrank back under its bound.
+    cache.put(key1, val1);
     cache.put(key2, val2);
-    Assert.assertNull(cache.get(key1));
-    Assert.assertArrayEquals(val2, cache.get(key2));
-    Assert.assertEquals(34, cache.getCache().stats().evictionWeight());
+    cache.getCache().cleanUp();
+
+    Assert.assertTrue(
+        "Expected eviction weight > 0 after exceeding max size, got "
+        + cache.getCache().stats().evictionWeight(),
+        cache.getCache().stats().evictionWeight() > 0
+    );
+    Assert.assertEquals(1, cache.getCache().asMap().size());
   }
 
   @Test