Found banned dependency while wrapping api into a Jenkins plugin

[baymac]

Working on a Gitlab Plugin for Jenkins. Right now the API is inside the plugin so we need to take it out of the plugin. We have planned to use this Gitlab Java API for our Gitlab-API-plugin.

Gitlab-api-plugin is just an empty plugin which wraps the gitlab-api and let's other plugins use it's api.

When I am compiling the plugin I am facing this error:
[INFO] --- maven-enforcer-plugin:3.0.0-M1:enforce (display-info) @ gitlab-api ---
[INFO] Restricted to JDK 1.7 yet javax.xml.bind:jaxb-api:jar:2.3.1:compile contains javax/xml/bind/JAXBElement.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.media:jersey-media-multipart:jar:2.27:compile contains org/glassfish/jersey/media/multipart/BodyPart.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.core:jersey-client:jar:2.27:compile contains org/glassfish/jersey/client/AbortException.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet javax.ws.rs:javax.ws.rs-api:jar:2.1:compile contains javax/ws/rs/ApplicationPath.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.inject:jersey-hk2:jar:2.27:compile contains org/glassfish/jersey/inject/hk2/AbstractHk2InjectionManager.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.core:jersey-common:jar:2.27:compile contains org/glassfish/jersey/Beta.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.gitlab4j:gitlab4j-api:jar:4.9.19:compile contains org/gitlab4j/api/AbstractApi.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.connectors:jersey-apache-connector:jar:2.27:compile contains org/glassfish/jersey/apache/connector/ApacheClientProperties.class targeted to JDK 1.8
[INFO] Ignoring requireUpperBoundDeps in com.google.guava:guava
[INFO] Ignoring requireUpperBoundDeps in com.google.code.findbugs:jsr305
[WARNING] Rule 3: org.apache.maven.plugins.enforcer.EnforceBytecodeVersion failed with message:
Found Banned Dependency: javax.xml.bind:jaxb-api:jar:2.3.1
Found Banned Dependency: org.glassfish.jersey.media:jersey-media-multipart:jar:2.27
Found Banned Dependency: org.glassfish.jersey.core:jersey-client:jar:2.27
Found Banned Dependency: javax.ws.rs:javax.ws.rs-api:jar:2.1
Found Banned Dependency: org.glassfish.jersey.inject:jersey-hk2:jar:2.27
Found Banned Dependency: org.glassfish.jersey.core:jersey-common:jar:2.27
Found Banned Dependency: org.gitlab4j:gitlab4j-api:jar:4.9.19
Found Banned Dependency: org.glassfish.jersey.connectors:jersey-apache-connector:jar:2.27
Use 'mvn dependency:tree' to locate the source of the banned dependencies.
[WARNING] Rule 6: org.apache.maven.plugins.enforcer.RequireUpperBoundDeps failed with message:
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for javax.servlet:javax.servlet-api:3.1.0 paths to dependency are:
+-io.jenkins.plugins:gitlab-api:1.0-SNAPSHOT
  +-javax.servlet:javax.servlet-api:3.1.0
and
+-io.jenkins.plugins:gitlab-api:1.0-SNAPSHOT
  +-org.gitlab4j:gitlab4j-api:4.9.19
    +-javax.servlet:javax.servlet-api:3.1.0 (managed) <-- javax.servlet:javax.servlet-api:4.0.1
and
+-io.jenkins.plugins:gitlab-api:1.0-SNAPSHOT
  +-org.jenkins-ci.main:jenkins-test-harness:2.34
    +-org.eclipse.jetty:jetty-security:9.4.5.v20170502
      +-org.eclipse.jetty:jetty-server:9.4.5.v20170502
        +-javax.servlet:javax.servlet-api:3.1.0 (managed) <-- javax.servlet:javax.servlet-api:4.0.1
]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 15.537 s
[INFO] Finished at: 2019-04-06T06:26:20+05:30
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.0.0-M1:enforce (display-info) on project gitlab-api: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed. -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

I think it says some of the libraries used in this API doesn't support JDK 1.8.

Our plugin will be using some Java 8 features so I also want this API to support Java 8. How much work is needed to support Java 8?

[gmessner]

@baymac
I believe you may be misinterpreting the warning, GitLab4J-API requires Java 8 and is compiled with Java 8, it will not work in any version of Java prior to Java 8. It looks like you are compiling with Java 1.7 based on these errors from above:

[INFO] Restricted to JDK 1.7 yet javax.xml.bind:jaxb-api:jar:2.3.1:compile contains javax/xml/bind/JAXBElement.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.media:jersey-media-multipart:jar:2.27:compile contains org/glassfish/jersey/media/multipart/BodyPart.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.core:jersey-client:jar:2.27:compile contains org/glassfish/jersey/client/AbortException.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet javax.ws.rs:javax.ws.rs-api:jar:2.1:compile contains javax/ws/rs/ApplicationPath.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.inject:jersey-hk2:jar:2.27:compile contains org/glassfish/jersey/inject/hk2/AbstractHk2InjectionManager.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.core:jersey-common:jar:2.27:compile contains org/glassfish/jersey/Beta.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.gitlab4j:gitlab4j-api:jar:4.9.19:compile contains org/gitlab4j/api/AbstractApi.class targeted to JDK 1.8
[INFO] Restricted to JDK 1.7 yet org.glassfish.jersey.connectors:jersey-apache-connector:jar:2.27:compile contains org/glassfish/jersey/apache/connector/ApacheClientProperties.class targeted to JDK 1.8

[baymac]

Hi @gmessner, thanks for the hint. My Java experience is relatively less so facing some setup issues. Almost all of dependencies issue are gone after doing what you suggested (elevated to java version - 8). Now there is this one issue:

[INFO] --- maven-enforcer-plugin:3.0.0-M1:enforce (display-info) @ gitlab-api ---
[INFO] Restricted to JDK 1.8 yet javax.xml.bind:jaxb-api:jar:2.3.1:compile contains META-INF/versions/9/javax/xml/bind/ModuleUtil.class targeted to 53.0
[INFO] Ignoring requireUpperBoundDeps in com.google.guava:guava
[INFO] Ignoring requireUpperBoundDeps in com.google.code.findbugs:jsr305
[WARNING] Rule 3: org.apache.maven.plugins.enforcer.EnforceBytecodeVersion failed with message:
Found Banned Dependency: javax.xml.bind:jaxb-api:jar:2.3.1
Use 'mvn dependency:tree' to locate the source of the banned dependencies.
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 17.078 s
[INFO] Finished at: 2019-04-06T11:42:56+05:30
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.0.0-M1:enforce (display-info) on project gitlab-api: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed. -> [Help 1]

I think jaxb-api is aimed at Java 9 (major version 53.0). If I exclude that particular library (javax.xml.bind:jaxb-api), the mvn clean install builds the project.

The question is whether the library is essential for the API to work. I do not find any uses of jaxb-api in the source code of this repository. Also the source code of jaxb-api has been archived. Is excluding the library a good solution?

[gmessner]

@baymac
This library will not work without the jaxb-api library. I believe you simply need to change the settings for the maven-enforcer-plugin to specify a range for Java, not a specific version. This might help:
https://maven.apache.org/enforcer/enforcer-rules/versionRanges.html

[gmessner]

@baymac
I've just released 4.10.0. This was a fairly significant release that removes the need for JAXB, can you verify that this takes care of your maven-enforcer-plugin error and close this issue?

[baymac]

Thank you @gmessner for being so kind to bring these changes. It addressed my issue. I really appreciate your efforts in actively maintaining this repository.

[gmessner]

@baymac
You may want to upgrade to 4.10.4 (the latest release of this library). A few issues have been addressed that 4.10.0 introduced.

[baymac]

Got it. Thanks.

[baymac]

Hi @gmessner I am getting a similar error as earlier. Just want to know if I should find some way for adaption to these changes or sticking to older api version would do? If you have any suggestion of a possible solution let me know.

The only solution that I was able to come with so far is exclude the module-info.class from checking enforcer rules. But I am not sure if that is a good idea. I did it by adding the following to my pom.xml:

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <version>3.0.0-M1</version>
        <executions>
          <execution>
            <id>enforce-bytecode-version</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <enforceBytecodeVersion>
                  <maxJdkVersion>1.8</maxJdkVersion>
                  <ignoreClasses>
                    <ignoreClass>module-info</ignoreClass>
                  </ignoreClasses>
                </enforceBytecodeVersion>
              </rules>
            </configuration>
          </execution>
        </executions>
        <dependencies>
          <dependency>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>extra-enforcer-rules</artifactId>
            <version>1.0-beta-9</version>
          </dependency>
        </dependencies>
      </plugin>
    </plugins>
  </build>

Ref: https://stackoverflow.com/a/51880643/7814679

Will this cause incompatibility with any other plugin depending on it but restricted to JDK 1.8/Java 8?

[gmessner]

@baymac
This rule should not cause any dependency issues, all it is doing is configuring it to ignore the checking of the module-info classes. The module-info classes are only needed if someone is using this library with Java 9+. It has no effect on things at runtime, only effects things during the run of the enforcer plugin.

IMPORTANT:
I have just found out that the mod to remove JAXB from this library also wrongly removed the javax.activation dependency in the POM, this has broken the use of this library for anyone using Java 9+. Because of this, I will be adding the javax.activation plugin back in.

That being said, to simplify using this library with projects that are using the enforcer plugin, I will add the use of the enforcer plugin to this library and will add rules that take care of the sort of warnings you are getting, you can then use these rules in your child POM. They are basically the rules you found.

These changes will be released later today.