Codecov Report

❌ Patch coverage is 49.53271% with 54 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.72%. Comparing base (c6853e7) to head (a54dc73).

@@             Coverage Diff              @@
##             master    #3159      +/-   ##
============================================
- Coverage     37.72%   37.72%   -0.01%     
- Complexity     6521     6529       +8     
============================================
  Files           800      800              
  Lines         68821    68882      +61     
  Branches       9127     9147      +20     
============================================
+ Hits          25965    25988      +23     
- Misses        39815    39844      +29     
- Partials       3041     3050       +9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Why this branch contains PD Raft changes

The PD change in 3d9d9544 is independent of the REST API 0.72 bump. It was identified while preparing the real 3-PD distributed matrix, where PD peers use stable hostnames but container/Pod IPs may change after restart or membership updates.

Before:

• IpAuthHandler resolved peer hostnames only at startup or an explicit peer-list update;
• the same hostname resolving to a new Pod IP could leave the Raft allowlist stale and reject a valid peer;
• peer changes could update Raft membership without a reliably synchronized allowlist;
• a fully unresolved/empty result followed the old allow-all path;
• resolver, singleton, RPC-server and failed-start cleanup were incomplete.

After:

• configured/runtime peer addresses are normalized and bounded before use;
• DNS resolution has timeout, concurrency and stale-entry limits, with background refresh;
• successful membership changes refresh the active allowlist;
• startup/shutdown failures clean the resolver, handler and RPC resources;
• unit, service-update and Raft integration tests cover these boundaries.

Most of the apparent size is defensive behavior and tests: this commit is +1375/-226, including about 700 added test lines and relocation/expansion of the old IpAuthHandlerTest.

Scope note: this is not required to distinguish API 0.71 from 0.72, nor by the Hubble permission capability itself. It should be reviewed as a standalone PD reliability/security change (and preferably split from the API-version PR). Passing tests do not replace the pending final 3+3+3 runtime validation.

Scope freeze

The Hubble dependency is limited to the API 0.72 contract and the GraphSpace-wide default-role behavior. The PD Raft DNS/IP work is independent and must not grow further except for a blocker reproduced by the required 3+3+3 runtime. It should remain separately reviewable/splittable from the Hubble compatibility change.

Superseded by hugegraph#198. The reviewed fixes and remaining compatibility acceptance are now tracked in the organization repository; please close this ASF PR.

TODO follow-ups intentionally kept out of this minimal API 0.72 closeout:

1. Design an explicit, versioned migration/cleanup path for legacy
   <graph>_observer bindings, including deleted-and-recreated graph names.
   API 0.72 now uses explicit ALL_GRAPHS; request-time graph scans and hidden
   role mutation were removed rather than extended.
   Context: refactor(server): adapt REST API for hubble #3159 (comment)
2. Coordinate graph deletion with concurrent data/schema mutations through one
   documented graph-wide lifecycle gate, including lock ordering and a
   concurrency regression. This spans the existing storeProvider.clear()
   boundary and should not be approximated by a local HStore-only lock.
   Context: refactor(server): adapt REST API for hubble #3159 (comment)
3. Define exact-once schema-cache notification ownership for HStore graph clear
   without losing the direct broadcast required when
   task.sync_deletion=true. The final code preserves correctness and may emit
   a bounded duplicate under the default asynchronous-deletion path.
   Context: refactor(server): adapt REST API for hubble #3159 (comment)

These are explicit follow-ups, not silently implemented compatibility behavior
in this PR. The final head keeps the HStore metadata/cache clear bugfix, restores
the required direct remote invalidation, and leaves broader lifecycle/event
redesign for a separately scoped change.

Final dependency-review rerun note: attempt 3 completed with the same stale all-dependencies-added snapshot and failed on existing vulnerable/low-score packages. The PR changes no dependency coordinates; its only pom.xml delta changes the API JAR Implementation-Version from 0.71.0.0 to 0.72.0.0. The repository-specific dependency-check job passes, all build/storage/Docker jobs pass, and Codecov patch/project pass. This dependency-review result is classified as a base-snapshot failure rather than a current-head dependency regression; no product or dependency suppression change is made.