Java 11 related library compatibility fix

WrenSecurity / wrensec-commons

Community fork of ForgeRock Commons, which contains common utility code used by multiple products originally developed by ForgeRock.

http://wrensecurity.org

0 stars 10 forks source link

Java 11 related library compatibility fix #28

Closed krystofNovotny closed 3 years ago

krystofNovotny commented 3 years ago

This pull request addresses issues created by updating some of the commons' dependencies. The main changes are

rename com.jayway.restassured to io.rest-assured
revert servlet-api update to 3.1.0
override versions of snakeyaml and guava managed by testng causing clash with demands of swagger
replace jaxb servicemix with jaxb-osgi and jakarta.xml.bind
prevent (previously hidden and silently ignored by bundle plugin) Xerces dependency from creeping into the utils' manifest
few minor cosmetic fixes like adding relativepath to parent pom and removing unnecessary version specifiers when the version is already managed

pavelhoral commented 3 years ago

Looks good, the only suspicious thing is the JAXB dependency change. Also seems to be the reason why CI build failed.

I would rather stick with Jakarta's JAXB and potentially solve issue with OSGi down the line in Wren:IDM (e.g. do a switcheroo for servicemix's bundle if that is somehow doable - depends on what is being written in manifest).

Also I would very much like to have some sort of report what was changed in all the bundles regarding wiring specification (Import/Export-Package). If that is somehow possible to get, that would be awesome (maybe via bnd-reporter-maven-plugni or maybe we can ask bnd or felix community).

krystofNovotny commented 3 years ago

Jaxb issue

The JAXB dependency change is from https://github.com/eclipse-ee4j/jaxb-ri It's still maintained and actively developed even though the package name com.sun.xml.bind suggests otherwise.

I believe this to be just a package naming thing. They even have a 3.0.0 version renaming the package to org.glassfish.jaxb.

I didn't choose the newest version because it clashed with Wren:IDM libraries.

Other changes

I excluded transitional dependency on jakarta.activation brought in by jaxb-osgi
Dependency on jakarta.xml.bind was unnecesarry because it is brought in by jaxb-osgi, so I removed it

pavelhoral commented 3 years ago

I created comparison os OSGi metadata created by building a0c22cd (before any dependency update) with JDK 8 and from the HEAD of this PR created by building with JDK 11 - https://gist.github.com/pavelhoral/3efd66e695399a581cd0b9a79f1544d4 . All changes look OK.