Bump Jersey version from 3.1.3 to 3.1.5

[epag]

---

Author Name: Evan (Evan) Original Redmine Issue: 124200, https://vlab.noaa.gov/redmine/issues/124200 Original Date: 2023-12-18 Original Assignee: Evan

---

When attempting to bump the minor version of @org.glassfish.jersey@ from @3.1.3@ to @3.1.5@ we started to encounter the following error when starting a server:

2023-12-18 12:11:51 2023-12-18T17:11:51.880+0000 INFO Functions Executing: server 8010
2023-12-18 12:11:51 2023-12-18T17:11:51.883+0000 INFO Functions Starting server on default port 8010, if you would like to provide a port to use  do so like this: bin/wres.bat server 8010
2023-12-18 12:11:51 Exception in thread "main" java.lang.NoClassDefFoundError: org/eclipse/jetty/server/HttpChannel$Listener
2023-12-18 12:11:51     at wres.Functions.startServer(Functions.java:522)
2023-12-18 12:11:51     at wres.Functions.call(Functions.java:160)
2023-12-18 12:11:51     at wres.Main.runSimpleOperation(Main.java:180)
2023-12-18 12:11:51     at wres.Main.main(Main.java:75)
2023-12-18 12:11:51 Caused by: java.lang.ClassNotFoundException: org.eclipse.jetty.server.HttpChannel$Listener
2023-12-18 12:11:51     at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
2023-12-18 12:11:51     at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
2023-12-18 12:11:51     at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:525)
2023-12-18 12:11:51     ... 4 more

I believe this is due to @org.eclipse.jetty:jetty-server [11.0.18 -> 12.0.4]@ requiring a major bump

---

Redmine related issue(s): 125686, 126666, 131911

---

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T17:52:55Z

---

I am not sure if I am understanding this correctly, but running ./gradlew dependicies I see the following:

+--- org.glassfish.jersey.containers:jersey-container-jetty-http:3.1.5
|    +--- jakarta.inject:jakarta.inject-api:2.0.1
|    +--- org.eclipse.jetty:jetty-server:12.0.3 (*)

I believe this to mean that the org.glassfish.jersey.containers: is trying to leverage jetty-server:12.0.3 which we are not bumped to and when we do causes issues. I am going to make a new ticket and shelf this bump for the time being

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T17:53:51Z

---

The error when bumping jersey stuff from @3.1.3@ to @3.1.5@:

2023-12-18 12:11:51 17:11:51,520 |-INFO in ch.qos.logback.classic.LoggerContext[default] - This is logback-classic version 1.4.14
2023-12-18 12:11:51 17:11:51,522 |-INFO in ch.qos.logback.classic.util.ContextInitializer@4d9e68d0 - No custom configurators were discovered as a service.
2023-12-18 12:11:51 Exception in thread "main" java.lang.NoClassDefFoundError: org/eclipse/jetty/server/HttpChannel$Listener
2023-12-18 12:11:51     at wres.Functions.startServer(Functions.java:522)
2023-12-18 12:11:51     at wres.Functions.call(Functions.java:160)
2023-12-18 12:11:51     at wres.Main.runSimpleOperation(Main.java:180)
2023-12-18 12:11:51     at wres.Main.main(Main.java:75)
2023-12-18 12:11:51 Caused by: java.lang.ClassNotFoundException: org.eclipse.jetty.server.HttpChannel$Listener
2023-12-18 12:11:51     at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
2023-12-18 12:11:51     at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
2023-12-18 12:11:51     at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:525)
2023-12-18 12:11:51     ... 4 more

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T17:55:07Z

---

Minor updates being skipped:

 - org.glassfish.jersey.containers:jersey-container-jetty-http [3.1.3 -> 3.1.5]
     https://projects.eclipse.org/projects/ee4j.jersey
 - org.glassfish.jersey.containers:jersey-container-servlet [3.1.3 -> 3.1.5]
     https://projects.eclipse.org/projects/ee4j.jersey
 - org.glassfish.jersey.containers:jersey-container-servlet-core [3.1.3 -> 3.1.5]
     https://projects.eclipse.org/projects/ee4j.jersey
 - org.glassfish.jersey.core:jersey-server [3.1.3 -> 3.1.5]
     https://projects.eclipse.org/projects/ee4j.jersey
 - org.glassfish.jersey.inject:jersey-hk2 [3.1.3 -> 3.1.5]
     https://projects.eclipse.org/projects/ee4j.jersey
 - org.glassfish.jersey.media:jersey-media-multipart [3.1.3 -> 3.1.5]
     https://projects.eclipse.org/projects/ee4j.jersey

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T18:18:18Z

---

Removing uneeded dependency actually fixes this:

@runtimeOnly 'org.glassfish.jersey.containers:jersey-container-jetty-http:3.1.5'@

[epag]

---

Original Redmine Comment Author Name: James (James) Original Date: 2023-12-18T18:22:02Z

---

I would be very careful about simply eliminating dependencies because they may apply conditionally, such as for http 1.0 vs. http 2.0.

You should probably look carefully into the history of that dependency in our app so that you can explain why it is appropriate to delete the dependency, i.e., at which point it became obe. Compiling does not mean working.

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T18:22:58Z

---

I complied, built images, spun up a local server and fired off a smoke test job

[epag]

---

Original Redmine Comment Author Name: James (James) Original Date: 2023-12-18T18:23:55Z

---

Also, eliminating a dependency to simply get around a bug in the dependency isn't the best way to expose bugs and get them fixed. If the dependency contains a bug, it would be better to report.

But, sure, if we really no longer depend on the broken dependency, we shouldn't include it, and then it's up to you whether you want to help them out by reporting.

[epag]

---

Original Redmine Comment Author Name: James (James) Original Date: 2023-12-18T18:24:35Z

---

Evan wrote:

I complied, built images, spun up a local server and fired off a smoke test job

Doesn't mean it's working in all circumstances. You need to run down the history of that dep.

[epag]

---

Original Redmine Comment Author Name: James (James) Original Date: 2023-12-18T18:25:41Z

---

Bottom line, unless we can explain why something works, we cannot be completely confident that it does and we can expect to get bitten.

[epag]

---

Original Redmine Comment Author Name: James (James) Original Date: 2023-12-18T18:28:49Z

---

There are some useful tools within gradle for exploring specific dependencies, like @dependencyInsight@:

https://docs.gradle.org/current/userguide/viewing_debugging_dependencies.html

I see you've found the one for reporting the overall dependency tree, but it can be useful to run the dependency-specific commands to learn more.

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T18:38:20Z

---

Doing some more investigation

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T18:55:04Z

---

Just to specify from the title, it seems like the rest of the Jersey stuff can be bumped fine, it is just this that causes issues

    runtimeOnly 'org.glassfish.jersey.containers:jersey-container-jetty-http:3.1.5'

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T19:24:15Z

---

This was first added 5 years ago, but I don't really see a reason for it to be added

https://vlab.noaa.gov/redmine/projects/wres/repository/revisions/c7179337afb26b006e31c78e839d861cf59040ba/diff

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T19:25:15Z

---

I can potential publish a build scan (Not sure if we are allowed to do this) to see if this dependency is used, only other thing I can see is some linter tools to remove unused dependencies. Otherwise not too sure why this is breaking things. Unsure where I could find a changelog between versions

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T19:55:18Z

---

Looks like this introduces the package @org.glassfish.jersey.jetty@ which I never have been being used for the entire history of the project. I wont remove this, but I am going to keep it at its old version

runtimeOnly 'org.glassfish.jersey.containers:jersey-container-jetty-http:3.1.3'

Let me know if you have any other ideas James, but otherwise will just push these changes so we can continue the deploy tomorrow when Hank is back

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T20:51:50Z

---

Looking at the releases for this https://github.com/eclipse-ee4j/jersey/releases

It looks like 3.1.4 removed jetty 11 support, not sure if this is the issue, but best I can come up with. I still am not seeing where we are using this

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T20:54:14Z

---

Also looking at the class hierarchy for this package, I don't see it being used by anything other than the classes that itself introduces. (At least that is how I believe I interpret this)

https://javadoc.io/doc/org.glassfish.jersey.containers/jersey-container-jetty-http/latest/org/glassfish/jersey/jetty/package-tree.html

So, I think this might have just been added in 5 years ago without need and just never cleaned up. Not quite sure how to be sure though

[epag]

---

Original Redmine Comment Author Name: James (James) Original Date: 2023-12-18T20:58:27Z

---

I think it's reasonable to retain the 3.1.3 until we've got an explanation. I think the next step is to write a ticket for the jersey devs. I would try to narrow down to 3.1.4 and ask w/r to that release. It may be related to jetty 11 --> jetty 12, but I don't see why, as it's for each package to manage its own dependencies.

We may be able to ditch the dependency, but I would prefer to do this more conservatively, i.e., not immediately prior to a release, but at the start of the next one.

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T21:07:22Z

---

Can confirm going to @jersey-container-jetty-http:3.1.4@ introduces the same issue

2023-12-18 16:05:11 Exception in thread "main" java.lang.NoClassDefFoundError: org/eclipse/jetty/server/HttpChannel$Listener
2023-12-18 16:05:11     at wres.Functions.startServer(Functions.java:522)
2023-12-18 16:05:11     at wres.Functions.call(Functions.java:160)
2023-12-18 16:05:11     at wres.Main.runSimpleOperation(Main.java:180)
2023-12-18 16:05:11     at wres.Main.main(Main.java:75)
2023-12-18 16:05:11 Caused by: java.lang.ClassNotFoundException: org.eclipse.jetty.server.HttpChannel$Listener
2023-12-18 16:05:11     at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
2023-12-18 16:05:11     at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
2023-12-18 16:05:11     at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:525)
2023-12-18 16:05:11     ... 4 more

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2023-12-18T21:09:00Z

---

I might also look into introducing a dependency linter to help clean up unused dependencies (Also these tools might provide insight into if this dependency is truly unused)

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2024-05-21T16:18:28Z

---

Moving this to 6.24, 6.23 is going to be a docker only deploy

[epag]

---

Original Redmine Comment Author Name: Evan (Evan) Original Date: 2024-07-02T13:17:06Z

---

Wasn't done