Analysis of Apache Commons Project dependencies on JDK-Internal APIs

[Rory O'Donnell <ro...@oracle.com>]

Hi Benedict,

As part of the preparations for JDK 9, Oracle's engineers have been 
analyzing open source projects like
yours to understand usage. One area of concern involves identifying 
compatibility problems, such as
reliance on JDK-internal APIs.

Our engineers have already prepared guidance on migrating some of the 
more common usage patterns
of JDK-internal APIs to supported public interfaces. The list is on the 
OpenJDK wiki [0], along with instructions
on how to run the jdeps analysis tool yourself .

We have analyzed jar files within the following Apache Commons Projects 
and found 0 jar files depending on
JDK-Internal-APIs  :
bcel-5.2, bsf-2.4.0, commons-beanutils-1.9.2,commons-chain-1.2, 
commons-cli-1.2,
commons-codec-1.9, commons-collections4-4.0, commons-compress-1.8.1, 
commons-configuration-1.10,
commons-csv-1.0, commons-daemon-1.0.15, commons-dbcp2-2.0.1, 
commons-dbutils-1.6, commons-digester3-3.2 ,
commons-discovery-0.5, commons-el-1.0, commons-email-1.3.3, 
commons-exec-1.2 , commons-fileupload-1.3.1-bin, commons-io-2.4, 
commons-jci-1.1, commons-jexl-2.1.1, commons-jxpath-1.3, 
commons-lang3-3.3.2,
commons-logging-1.2, commons-math3-3.3, commons-modeler-2.0.1, 
commons-net-3.3, commons-pool2-2.2,
commons-primitives-1.0, commons-scxml-0.9 , commons-transaction-1.2, 
commons-validator-1.4.0, commons-vfs-2.0.

However, jdeps is a static analysis tool and therefore use of 
JDK-internal APIs via reflection or dynamically
generated bytecode are not reported by the tool, while such a dependency 
should also be replaced.

If you have any feedback please reply either on this list or to me 
directly.

We have also analyzed commons-jelly-1.0 & commons-launcher-1.1 , I will 
send you separate emails
with their reports.

Rgds,Rory

[0] 
https://wiki.openjdk.java.net/display/JDK8/Java+Dependency+Analysis+Tool

-- 
Rgds,Rory O'Donnell
Quality Engineering Manager
Oracle EMEA , Dublin, Ireland