[jira] [Comment Edited] (SM-4727) [opensaml] Invalid range for javax.annotation import

["Arnaud MERGEY (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SM-4727?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17318905#comment-17318905 ] 

Arnaud MERGEY edited comment on SM-4727 at 4/11/21, 5:47 PM:
-------------------------------------------------------------

it is better to set it as optional but having the range 1,4 is really wrong because it matches things unrelated

 javax.annotation[1,3) is this :
{code:java}
<dependency>
 <groupId>jakarta.annotation</groupId>
 <artifactId>jakarta.annotation-api</artifactId>
 <version>1.3.5</version>
</dependency>{code}
and javax.annotation[3,4) is this :
{code:java}
<dependency>
 <groupId>com.google.code.findbugs</groupId>
 <artifactId>jsr305</artifactId>
 <version>3.0.2</version>
</dependency>{code}


was (Author: amergey):
it is better to set it as optional but having the range 1,4 is really wrong because it matchs things unrelated

 javax.annotation[1,3) is this :
{code:java}
<dependency>
 <groupId>jakarta.annotation</groupId>
 <artifactId>jakarta.annotation-api</artifactId>
 <version>1.3.5</version>
</dependency>{code}
and javax.annotation[3,4) is this :
{code:java}
<dependency>
 <groupId>com.google.code.findbugs</groupId>
 <artifactId>jsr305</artifactId>
 <version>3.0.2</version>
</dependency>{code}

> [opensaml] Invalid range for javax.annotation import
> ----------------------------------------------------
>
>                 Key: SM-4727
>                 URL: https://issues.apache.org/jira/browse/SM-4727
>             Project: ServiceMix
>          Issue Type: Bug
>          Components: bundles
>            Reporter: Arnaud MERGEY
>            Assignee: Freeman Yue Fang
>            Priority: Major
>             Fix For: bundles-2021.04
>
>
> opensaml 3.4.6 is importing javax annotation with this range version 1 to version 4 while it depends on jsr305 (javax.annotation 3)
> javax.annotation v1 corresponds to jee annotation (jakarta.annotation-api) which completely unrelated to jsr305 (even if they share same package name which is a shame but that's another story) 
> I am not sure it is really a big deal as jsr305 are not supposed to be retained at runtime, but there could be some strange wiring effects. I think javax.annotation shoud be from v3 to v4 for open saml (and maybe set as optional) instead of
> {code:java}
> javax.annotation;version="[1,4)",{code}



--
This message was sent by Atlassian Jira
(v8.3.4#803005)