Remove deprecated API usage and prevent regressions #20525

Druid currently has 1,911 open CodeQL java/deprecated-call alerts across 579 files. Most occur in test sources, but 488 are in production sources.

CodeQL alerts

This issue tracks migrating deprecated API calls, removing obsolete internal Druid APIs, and adding enforcement where practical. The counts below reflect the alert inventory retrieved on October 8, 2026, and may change as fixes land.

Major cleanup areas

Proposed approach

Druid APIs

Migrate callers to the supported replacements and remove deprecated internal declarations in the same change.

Removal candidates should be outside the API surface protected by @PublicApi or @ExtensionPoint. Check annotations on individual members and contracts inherited from parent classes or interfaces, as well as annotations on the declaring class.

Separately review methods used by serialization, configuration, HTTP endpoints, persisted metadata, reflection, or dependency injection. These may have compatibility requirements even without either annotation.

Dependency and JDK APIs

Follow the replacement guidance for each dependency while preserving behavior. Split the work into focused PRs by API family or module.

For deprecated URL constructors:

• Replace ordinary construction with URI followed by toURL().
• Use Path.toUri() or File.toURI() for filesystem paths.
• Review relative URLs, escaping, exception handling, and custom URLStreamHandler usage.
• Add all deprecated URL constructor overloads to codestyle/druid-forbidden-apis.txt to prevent regressions.

Cases requiring care

• DataSegment.builder(SegmentId) has different defaults from the deprecated no-argument builder. Preserve existing values where necessary.
• SQL expression tests should compare complete typed DruidExpression structures when migrating away from deprecated helpers.
• Compatibility bridges in extension APIs require an explicit compatibility decision before removal.
• Replacing ResourcePool finalization requires preserving resource cleanup behavior.
• Hashing changes must preserve compatibility with existing partition assignments and persisted identifiers.
• Guava exception propagation replacements must preserve checked exceptions, unchecked exceptions, and null handling.

Completion criteria

• Migrate deprecated calls in focused batches.
• Remove deprecated internal Druid APIs that no longer need compatibility support.
• Add forbidden API rules for deprecated URL constructors.
• Run affected tests and static checks for each batch.
• Confirm resolved alerts after CodeQL rescans.
• Document any retained deprecated calls and the specific reason for retaining them.

Blanket suppression or removing deprecation annotations solely to silence warnings should not be used to resolve this issue.

Disclosure: This issue was prepared and created by Codex, an OpenAI AI assistant, on behalf of @FrankChen021, who reviewed the description and authorized its submission.