Pac4J Dependency Issues

[larry mccay <lm...@apache.org>]

All -

It seems that there are some automated builds that are occasionally having
issues with the pac4j provider dependencies. Apparently, there are
transitive dependencies of pac4j that have been set with a range of
versions within maven.

This makes the dependency a moving target and will sometimes not even
resolve for some reason.

I am going to lock the troublesome nimbus dependency down to the 1.4.3
version for now but we will need to keep this in sync with the actual pac4j
lib going forward. I'll open a JIRA for the same.

@Jerome - would you consider not using a range for the versions on it as it
is created build problems and I would rather not add an explicit dependency
on something only needed by pac4j that we have to keep aligned. We would
then be able to remove ours the next time we upgrade.

thanks,

--larry

Re: Pac4J Dependency Issues

[larry mccay <la...@gmail.com>]

Sure thing.
Thanks, Jérôme!

On Thu, Mar 29, 2018 at 8:39 AM, Jérôme LELEU <le...@gmail.com> wrote:

> Hi,
>
> I have always found the versions range troublesome. I'll be glad to get rid
> of it in pac4j.
>
> Can you open a pull request for that?
>
> Thanks.
> Best regards,
> Jérôme
>
>
> On Wed, Mar 28, 2018 at 9:14 PM, larry mccay <lm...@apache.org> wrote:
>
> > All -
> >
> > It seems that there are some automated builds that are occasionally
> having
> > issues with the pac4j provider dependencies. Apparently, there are
> > transitive dependencies of pac4j that have been set with a range of
> > versions within maven.
> >
> > This makes the dependency a moving target and will sometimes not even
> > resolve for some reason.
> >
> > I am going to lock the troublesome nimbus dependency down to the 1.4.3
> > version for now but we will need to keep this in sync with the actual
> pac4j
> > lib going forward. I'll open a JIRA for the same.
> >
> > @Jerome - would you consider not using a range for the versions on it as
> it
> > is created build problems and I would rather not add an explicit
> dependency
> > on something only needed by pac4j that we have to keep aligned. We would
> > then be able to remove ours the next time we upgrade.
> >
> > thanks,
> >
> > --larry
> >
>

Re: Pac4J Dependency Issues

[Jérôme LELEU <le...@gmail.com>]

Hi,

I have always found the versions range troublesome. I'll be glad to get rid
of it in pac4j.

Can you open a pull request for that?

Thanks.
Best regards,
Jérôme


On Wed, Mar 28, 2018 at 9:14 PM, larry mccay <lm...@apache.org> wrote:

> All -
>
> It seems that there are some automated builds that are occasionally having
> issues with the pac4j provider dependencies. Apparently, there are
> transitive dependencies of pac4j that have been set with a range of
> versions within maven.
>
> This makes the dependency a moving target and will sometimes not even
> resolve for some reason.
>
> I am going to lock the troublesome nimbus dependency down to the 1.4.3
> version for now but we will need to keep this in sync with the actual pac4j
> lib going forward. I'll open a JIRA for the same.
>
> @Jerome - would you consider not using a range for the versions on it as it
> is created build problems and I would rather not add an explicit dependency
> on something only needed by pac4j that we have to keep aligned. We would
> then be able to remove ours the next time we upgrade.
>
> thanks,
>
> --larry
>