search

O2-Czech-Republic / proxima-platform

The Proxima platform.
Apache License 2.0
18 stars 7 forks source link

proxima-core jar file contains unshaded dependencies #289

Open RadoBuransky opened 1 year ago

RadoBuransky commented 1 year ago

Current version 0.9.0 of the library produces JAR file which contains com.typesafe.config, com.google.* which causes runtime issues for the consumers of this library due to classpath conflicts. Please relocate/shade/rename these packages. Thanks

je-ik commented 1 year ago

The typesafe config is part of the API (ConfigRepository takes config), shading it can be possibility, but it would break current code. Can you use the same version of typesafe config as is used by the core?

Regarding com.google, that looks like a bug (errorprone, thirdparty).

je-ik commented 1 year ago

See datadrivencz#735

JozoVilcek commented 1 year ago

It would make sense to me to declare non-shade-relocated dependencies in POM ( and exclude from shaded JAR ) so they are a) directly visible to dev as to what is being used and b) let consumers of library resolve version conflicts via their build tools

je-ik commented 1 year ago

That makes sense. It would require some tools checking the API surface, so that the final jar actually contains only classes from cz.o2.proxima.* and all the rest would be excluded from shade. It would also require to publish the dependency-reduced.pom, which I'm not sure if we do now.

je-ik commented 11 months ago

Should be fixes with gradle build, see here. Might mot be applied to all io modules consistently yet.