Update all dependencies for 2.2

[coudot]

The goal is to update all dependencies for the next major release

[jailbird777]

Not sure if it helps (if it doesn't, sorry for the spam), but when I was hacking 2.1.x to work with Java 11, I did some updating and this combination is working. I ls'd the two directories (stock vs mine) and diff'd them:

-ant-optional-1.5.1.jar
-api-all-1.0.0-M22.jar
-avalon-framework-4.1.3.jar
-bcprov-jdk16-140.jar
-btm-2.1.0.jar
-commons-beanutils-1.7.0.jar
-commons-beanutils-core-1.7.0.jar
-commons-cli-1.2.jar
-commons-codec-1.3.jar
-commons-collections-3.2.1.jar
-commons-configuration-1.4.jar
-commons-digester-1.8.jar
-commons-io-1.4.jar
-commons-jxpath-1.2.jar
-commons-lang-2.5.jar
-commons-logging-1.1.jar
-commons-logging-api-1.0.4.jar
+ant-optional-1.5.3-1.jar
+api-all-1.0.3.jar
+avalon-framework-api-4.3.1.jar
+avalon-framework-impl-4.3.1.jar
+avalon-logkit-2.2.1.jar
+bcprov-jdk15on-164.jar
+btm-2.1.4.jar
+commons-beanutils-1.9.4.jar
+commons-cli-1.4.jar
+commons-codec-1.14.jar
+commons-collections-3.2.2.jar
+commons-configuration-1.10.jar
+commons-digester-2.1.jar
+commons-io-2.6.jar
+commons-jxpath-1.3.jar
+commons-lang-2.6.jar
+commons-logging-1.2.jar
+commons-logging-api-1.1.jar
-groovy-all-1.7.0.jar
-guava-11.0.2.jar
-hamcrest-core-1.1.jar
-hsqldb-1.8.0.10.jar
+groovy-all-2.4.19.jar
+guava-28.2-jre.jar
+hamcrest-core-2.2.jar
+hsqldb-2.5.0.jar
-javaee-api-5.jar
-javassist-3.16.1-GA.jar
-jcifs-1.2.19.jar
-jdom-b9.jar
-je-4.1.10.jar
-jline-0.9.94.jar
-jsr305-1.3.9.jar
+istack-commons-runtime-3.0.10.jar
+javaee-api-8.0.1.jar
+javassist-3.26.0-GA.jar
+javax.activation-api-1.2.0.jar
+javax.servlet-api-4.0.1.jar
+jaxb-api-2.4.0-b180830.0359.jar
+jaxb-core-2.3.0.1.jar
+jaxb-runtime-2.4.0-b180830.0438.jar
+jaxb-xjc-2.4.0-b180830.0438.jar
+jcifs-1.3.14-kohsuke-1.jar
+jdom-2.0.2.jar
+je-18.3.12.jar
+jline-3.14.0.jar
+jsr305-3.0.2.jar
-logback-classic-0.9.21.jar
-logback-core-0.9.21.jar
-logkit-1.0.1.jar
-mina-core-2.0.7.jar
-opendj-server-2.6.2.jar
+logback-classic-1.2.3.jar
+logback-core-1.2.3.jar
+mina-core-2.1.3.jar
+opendj-server-2.6.4.jar
-rhino-1.7R4.jar
-servlet-api-2.2.jar
-slf4j-api-1.6.0.jar
-stax-utils-20060502.jar
-tapestry5-annotations-5.2.5.jar
-ws-commons-util-1.0.1.jar
-xadisk-1.1.jar
-xerces-1.2.3.jar
-xmlrpc-client-3.0.jar
-xmlrpc-common-3.0.jar
+rhino-1.7.12.jar
+slf4j-api-1.7.30.jar
+stax-utils-20070216.jar
+tapestry5-annotations-5.4.5.jar
+ws-commons-util-1.0.2.jar
+xadisk-1.2.2.jar
+xercesImpl-2.12.0.jar
+xmlrpc-client-3.1.3.jar
+xmlrpc-common-3.1.3.jar
-xpp3-1.1.4c.jar
+xpp3-1.1.6.jar
-xstream-1.3.1.jar
+xstream-1.4.11.1.jar

[coudot]

We should update logback to at least 1.2.9, see https://github.com/lsc-project/lsc/security/dependabot/pom.xml/ch.qos.logback:logback-core/closed

[artlog]

working on

[coudot]

@abpai94 the goal is to try to upgrade dependencies in pom.xml to latest versions (if possible) and verify that LSC is still working (at least unit tests must pass)

[abpai94]

• Maven command to update all dependencies to the latest: mvn versions:use-latest-versions
• Checking mvnrepository website:
  • Check the libraries haven't been relocated
  • Check only release versions inserted into pom.xml

Note

Discovered a lot of libraries couldn't be upgraded to due to java 8 limitations. Moving to java 11 will enable more modern libraries. We may have reached the ceiling with some libraries due to bytecode class versioning becoming a limiting factor rather than java 8 limitations regardless of the jvm backwards compatibility in java 11+.
Libraries with version limitation due to this issue:

• logback-classic v1.3.13
• logback-core v1.3.14
• jaxb-core v3.0.0

[coudot]

Thanks @abpai94

@rouazana @soisik @davidcoutadeur I propose to keep Java 8 compatibility for LSC 2.2 and drop it for LSC 2.3.

[abpai94]

It appears that in Java 11 the jaxb-api library is completely removed. Although we include this library in the pom.xml and has been changed to use jakarta.xml.bind-api it appears we cannot increase version beyond v2.3.3. If we were to raise the minimum java requirement we may encounter this issue. It resulted in the maven build failing to complete in java 11.