search

javalin / javalin-openapi

Annotation processor for compile-time OpenAPI & JsonSchema, with out-of-the-box support for Javalin 5.x, Swagger & ReDoc
https://github.com/javalin/javalin-openapi/wiki
Apache License 2.0
45 stars 17 forks source link

Discussion: SwaggerUI / Webjars #160

Closed sauterl closed 1 year ago

sauterl commented 1 year ago

I leave this here, since it took quite a lot of effort to figure out where the culprit is and I do not understand the cause:

For unkown reasons (after multiple times clearing up any caches and what not), we do have a compileClasspath and a runtimeClasspath dependency to io.javalincommunity.openapi:javalin-swagger-plugin:5.3.3-SNAPSHOT. Which is fine by itself, however, the complieClasspath dependency has a transient dependency to org.webjars:swagger-ui:3.52.5 while the runtimeClasspath dependency resolves to a depencency to org.webjars:swagger-ui:4.10.3 (Yeah, a lot of depencency in this sentence, my apologies).

This leads to the issue that we have to manually override the SwaggerConfiguration.version property to the latest swagger-ui webjar version, as for some reason only the latest one is served properly.

Again, I do have no clue how we ended up in this situation, I just this could be helpful to others.

dzikoysk commented 1 year ago

Did you try to trace this dependency in a dependency tree? IntelliJ has pretty good tooling, so it should be possible to find it there. For Maven, you may also want to install Maven Helper plugin that provides convenient UI, for Gradle, the built-in analyzer does the job.

sauterl commented 1 year ago

@dzikoysk Thanks a lot - I wasn't aware of the analysier in IntelliJ and at Maven I didn't look, since I'm using gradle.

This revealed the culprit: The javalin-ssl plugin's transient dependency was referring to the more recent swagger-ui webjar.

Yet, I didn't fully understand why only the more recent webjar was served (in my case, the 3.52.5 couldn't be found, while the 4.10.3 one was served).

dzikoysk commented 1 year ago

I think you've found a bug with javalin-ssl plugin & javalin. This dependency shouldn't be pulled by your project, because it's a test-only dependency:

But javalin-ssl uses this pom as a parent pom:

So it's not aware of dependency scopes and just pulls everything to your project. You can exclude it, because Maven/Gradle prioritizes newer version.

sauterl commented 1 year ago

Thanks for checking the issue out so this issue resolved as soon as javalin-ssl / javalin are getting updated.

Again, amazing how fast you reply. Thanks a lot!