License-binary check fails on benign upstream version bumps
- Dominant language
- Scala
- Stars
- 314
- Forks
- 187
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 214
Description
### What happened?
`bin/licensing/check_binary_deps.py` compares bundled deps to `LICENSE-binary` claims using exact `name==version` strings. Whenever any claimed package gets a new upstream release (the license itself unchanged), the check fails on every PR — both as `NEW` (the freshly resolved version) and `STALE` (the previously documented version). This blocks PRs that have nothing to do with dependencies.
Concrete example — PR #4687 just failed the python license check on `tifffile`:
```
NEW Python packages not claimed by LICENSE-binary:
+ tifffile==2026.5.2
STALE Python packages claimed by LICENSE-binary but not actually bundled:
- tifffile==2026.4.11
```
`tifffile` is calver and ships ~monthly; same goes for several other claimed packages (`s3fs==2025.9.0`, `scikit-image==0.25.2`, etc.). The check breaks on cadence, not on actual license-relevant changes.
### How to reproduce?
1. Open any PR that doesn't touch `requirements.txt`.
2. Wait for an upstream of any LICENSE-binary-claimed Python or npm package to publish a new release.
3. Re-run the build job — `Check installed Python packages against LICENSE-binary` (or its npm counterpart) fails with `NEW` + `STALE` for the same package, only the version string differing.
### Version
1.1.0-incubating (Pre-release/Master)
### Commit Hash (Optional)
Failure surfaced on PR #4687 (https://github.com/apache/texera/actions/runs/25260954761/job/74068060023).
### Relevant log output
```
NEW Python packages not claimed by LICENSE-binary:
+ tifffile==2026.5.2
STALE Python packages claimed by LICENSE-binary but not actually bundled:
- tifffile==2026.4.11
##[error]Process completed with exit code 1.
```
Contributor guide
Assessment
This issue has not been assessed yet.