You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "elharo (via GitHub)" <gi...@apache.org> on 2024/11/11 00:24:32 UTC
[PR] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
elharo opened a new pull request, #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459
(no comment)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz closed pull request #459: [MDEP-964] Allowlist org.glassfish:javax.json
URL: https://github.com/apache/maven-dependency-plugin/pull/459
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1885423199
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
Probably less than 100 over time. Each one is an improvement.
javax.json because it's the next one I happened to stumble over when working on our own code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1903154024
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
We should put it in other list ... when we use it as default it will be overridden when user use own list.
Should be added always, maybe we need a new parameter like `useDefaultExcludes` or some else ...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1903154244
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
I'm not sure if we need add every dependencies which we need in a specific projects ....
In such way we will have very long list
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1903290844
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
What do you suggest? We could include a base list of dependencies we always ignore and allow the user to add to this list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1885401754
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
How big could this list of `hidden` default exclude be? and why this javax.json specially?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1926895627
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
Ping. There are two incompatible ways forward here and both have been requested by different people at different times. Either would be better than the status quo so we should choose one.
Option 1: There is a non-overridable list of dependencies we never warn about when they are declared but not used. A project can append to this list but not replace it.
Option 2: There is an overridable list of dependencies we never warn about when they are declared but not used. Projects can replace the entire list.
I prefer Option 1. It's simpler, and matches what almost everyone wants in practice. It emits fewer warnings and produces less noise. It will not break anyone's build. There are fewer false posiitives.
I'm OK with Option 2 if necessary. I think anything beyond these two options adds unnecessary complexity for no real world purpose.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1904085130
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
Do you want the user to replace the default list then, not simply append to it?
My gut is that we should not warn on anything we're not sure about, and we're never sure about dependencies like slf4j that are commonly used by reflection.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz commented on PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#issuecomment-6152141905
Closing per the discussion here: the appendable base list (option 1) should land first as its own PR. The single array element here also stops the existing slf4j-simple exclusion from matching, because the list isn't split on commas. #1458 stays open.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1903294411
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
> What do you suggest? We could include a base list of dependencies we always ignore and allow the user to add to this list.
exactly - user should have a possibility to not use default excluded list
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1903287851
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
I don't think we will have a very long list. ChatGPT-4 has roughly 1.8 *trillion* parameters. In 2025 that's a long list. Here, there might be a few dozen special cases occasionally encountered, though unless someone spends a lot of time on this, we will probably include less than ten. This is a *small* list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on code in PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#discussion_r1903290068
##########
src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java:
##########
@@ -231,7 +231,7 @@ public abstract class AbstractAnalyzeMojo extends AbstractMojo {
*
* @since 2.10
*/
- @Parameter(defaultValue = "org.slf4j:slf4j-simple::")
+ @Parameter(defaultValue = "org.slf4j:slf4j-simple::,org.glassfish:javax.json::")
Review Comment:
nevermind how list is long will be lost when user add own excludes, so we should implement it in other way
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [MDEP-964] Allowlist org.glassfish:javax.json [maven-dependency-plugin]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz commented on PR #459:
URL: https://github.com/apache/maven-dependency-plugin/pull/459#issuecomment-6024050021
Converted to draft: the master merge folded both patterns into one array element, `{"org.slf4j:slf4j-simple::,org.glassfish:javax.json::"}`. `StrictPatternExcludesArtifactFilter` splits only on `:`, so that element matches nothing and slf4j-simple is no longer ignored either, which is why the three slf4j-simple assertions had to go from https://github.com/apache/maven-dependency-plugin/blob/master/src/it/projects/analyze/verify.groovy#L39-L41.
To make it ready: two array elements, those assertions restored, javax.json assertions added, rebased. My -1 on allowlisting javax.json still stands; the fixed, appendable base list agreed earlier in this thread belongs in its own PR first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org