[MGNLREST-450] Multiple activation jars. Created: 29/Mar/22  Updated: 23/Oct/23  Resolved: 30/Aug/22

Status: Closed
Project: Magnolia REST Framework
Component/s: None
Affects Version/s: 2.2.14
Fix Version/s: 3.0.0, 2.2.15

Type: Bug Priority: Neutral
Reporter: Michiel Meeuwissen Assignee: Chuong Doan Huy
Resolution: Fixed Votes: 0
Labels: quickwin
Σ Remaining Estimate: Not Specified Remaining Estimate: Not Specified
Σ Time Spent: Not Specified Time Spent: Not Specified
Σ Original Estimate: Not Specified Original Estimate: Not Specified

Issue Links:
Relates
relates to MGNLREST-348 Multiple mail jars. Closed
relates to MGNLUI-7443 Don't use javax.activation for mimety... Open
relation
is related to MGNLREST-355 Migrate to jakarta.annotation-api Closed
is related to BUILD-871 Manage jakarta.activation dependencies Open
Sub-Tasks:
Key
Summary
Type
Status
Assignee
MGNLREST-473 Implement Sub-task Completed Chuong Doan Huy  
MGNLREST-474 Review code Sub-task Completed Mikaël Geljić  
MGNLREST-475 Pre-int QA Sub-task Closed Dai Ha  
MGNLREST-476 Final QA Sub-task Completed Jaroslav Simak  
Template:
Acceptance criteria:
Empty
Task DoD:
[X]* Doc/release notes changes? Comment present?
[X]* Downstream builds green?
[X]* Solution information and context easily available?
[X]* Tests
[X]* FixVersion filled and not yet released
[ ]  Architecture Decision Record (ADR)
Bug DoR:
[ ]* Steps to reproduce, expected, and actual results filled
[ ]* Affected version filled
Date of First Response:
Epic Link: Headless Phase 2
Sprint: DevX 17
Story Points: 3
Team: DeveloperX

 Description   

I find several 'activation' related dependencies.

 +- info.magnolia.rest:magnolia-rest-integration:jar:2.2.11:compile
[INFO] |  |  +- org.jboss.resteasy:resteasy-core-spi:jar:4.6.1.Final:compile
[INFO] |  |  |  +- org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.3_spec:jar:2.0.1.Final:provided
[INFO] |  |  |  +- org.jboss.spec.javax.annotation:jboss-annotations-api_1.3_spec:jar:2.0.1.Final:provided
[INFO] |  |  |  \- com.sun.activation:jakarta.activation:jar:1.2.1:compile
 +- info.magnolia.rest:magnolia-rest-services:jar:2.2.11:compile

[INFO] |  |  \- org.jboss.resteasy:resteasy-jaxb-provider:jar:4.6.1.Final:compile
[INFO] |  +- javax.xml.bind:jaxb-api:jar:2.3.1:provided
[INFO] |  |  \- javax.activation:javax.activation-api:jar:1.2.0:provided

I think it would be a good idea to make sure that the several magnolia dependencies agree on the activation coordinates that ought to be used. I suppose the most forward compatible coordinates would be jakarta.activation:jakarta.activation (See MGNLREST-355)



 Comments   
Comment by Mikaël Geljić [ 22/Aug/22 ]

chuong.doan I gave a shot at jhades on empty-webapp:

mvn dependency:copy -Dartifact='org.jhades:jhades-standalone-report:1.0.4' -DoutputDirectory=. && java -Ddetail=true -jar jhades-standalone-report-1.0.4.jar magnolia-empty-webapp/target/magnolia-empty-webapp-6.2-SNAPSHOT.war

and the output with a sample entry:

Total number of classes with more than one version: 1373
...
/javax/activation/DataSourceDataContentHandler.class has 3 versions on these classpath locations:

     - javax.activation-api-1.2.0.jar - class file size = 2483
     - jakarta.activation-1.2.1.jar - class file size = 2483
     - jakarta.activation-api-1.2.2.jar - class file size = 2538
...

For the record, the implementation jars are still under com.sun.. groupId, e.g. com.sun.activation:jakarta.activation, and for some reason they historically embed the javax spec packages as well...
So to keep things clean, we might:

  • mark activation-api deps as provided (most likely both of them)
  • plus since we still need an impl at the end of the day, either go for javax.activation or jakarta.activation v1 (avoid v2 where package namespace changes and breaks everything), and exclude the other one. Considering aligning mail module with what RESTEasy prefers (as the main 3rd-party transitive purveyor of those former JDK packages).

Doing further cleanup of other offenders should be a separate effort, activation-api only accounts for 47/1373 issues (also some false positives).

Eitherway, overlap of activation, mail, jaxb and such is harmless as minor/patch revisions are generally the same specs +/- javadoc amendments (as long as we don't step into the repackagings).

Comment by Richard Gange [ 15/Sep/22 ]

Hello mihxil-

This issue was fixed in Magnolia 6.2.23.

Cheers
Rich

Generated at Mon Feb 12 07:00:01 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.