search

eclipse-sisu / sisu-project

Sisu Inject
https://www.eclipse.org/sisu
Eclipse Public License 2.0
17 stars 15 forks source link

Update Maven Plugins #111

Closed cstamas closed 1 month ago

cstamas commented 1 month ago

Using all the latest Maven plugins (base for 3.6.3).

Left out spotless and bnd 7.0.0 (raises requirement for 3.8.1)

cstamas commented 1 month ago

The --add-opens made build green, but my problem is WHY it suddenly became needed?

mbien commented 1 month ago

The --add-opens made build green, but my problem is WHY it suddenly became needed?

the dependency updates likely cause different code paths now. A recent build on master was green so we probably can exclude the environment as cause (e.g JDK update which changed method modifiers somewhere or moved functionality to a different module).

btw cglib is no longer maintained!

IMPORTANT NOTE: cglib is unmaintained and does not work well (or possibly at all?) in newer JDKs, particularly JDK17+. If you need to support newer JDKs, we will accept well-tested well-thought-out patches... but you'll probably have better luck migrating to something like ByteBuddy.

-> https://github.com/cglib/cglib

looking at the maven downloads from the CI log:

[INFO] --- dependency:3.6.1:copy (guice3) @ org.eclipse.sisu.inject ---
...
 [INFO] Downloading from central: https://repo.maven.apache.org/maven2/com/google/inject/guice/3.0/guice-3.0.jar
...

this is getting quite dusty. cglib was likely used by guice at some point.

https://github.com/eclipse/sisu.inject/blob/e52a773bf41307d9e253555bee1eab587adef8a3/org.eclipse.sisu.inject/src/main/java/org/eclipse/sisu/inject/Guice4.java#L24-L27

cstamas commented 1 month ago

@mbien but the point is that there are no dependency updates, only plugin updates... This is what confuse me. Edit: there IS one update: junit 5.10.0 to 5.10.2... but again WHY is suddenly add-open needed?

cstamas commented 1 month ago

One suspect: surefire 3.2.2 (update went from 3.0.0 to 3.2.5) got this change: https://github.com/apache/maven-surefire/pull/682 update of plexus-java from 1.1.x to 1.2.x, that on other hand MAY cause that a dependency end up on module path instead of classpath...