Eliminate outdated 3rd party content from SimRel #438
Comments
This is produced and actively maintained by m2e:
In Eclipse-Platform this is used to process XPath expressions in E4 contributions. A while ago I looked into using the XPath supported provided by the JDK but didn't succeed yet. If there are no other users I could try to complete that work so we can get rid of that dependency in platform. |
The problem here (and in a small number of cases) is that the version in the Orbit aggregation is smaller than the older version. In this case 1.3.0 versus 1.3.0.v200911051830. As I hunt down these various cases, it's increasing frustrating the extent to which folks just keep pointing at older Orbit repositories sometimes for no apparent reason. And even if there is a reason, i.e., something is needed but is missing, that issue is never raised so of course never addressed. |
- Use version 1.0.3 which is newer than all the current 2.x versions eclipse-simrel/simrel.build#438
- Use version 1.0.3 which is newer than all the current 2.x versions eclipse-simrel/simrel.build#438
- The latest version of the bundle is named org.apache.commons.common-logging so better to avoid using the bundle name entirely. eclipse-simrel/simrel.build#438
https://bugs.eclipse.org/bugs/show_bug.cgi?id=583467 raised. It seems that MoDisco should never have redistributed org.apache.commons.jxpath. I can contribute MoDisco 1.5.5M1 to SimRel and so eliminate the redistributed org.apache.commons.jxpath once Jenkins gets some TLC. So far I have had 3 JustJ jobs fail with read timeout, 2 UI Gateway timeouts and jobs running at half speed. |
Thanks. That's great. Yes, the ci instances seem to be very slow to respond today. I had to be quite patient getting the Orbit milestones built. |
- The latest version of these are named org.apache.commons.common-io and org.apache.commons.common-logging so better to avoid using the bundle name entirely. eclipse-simrel/simrel.build#438
- org.apache.commons.logging -> org.apache.commons.commons-logging eclipse-simrel/simrel.build#438
- Use version 1.0.3 which is newer than all the current 2.x versions eclipse-simrel/simrel.build#438
- Use org.apache.commons.commons-logging when possible. eclipse-simrel/simrel.build#438
|
Please note that the Eclipse EASE project is depending on |
|
I think it's often tricky to find a replacement/updated version in a newer orbit update site because the bundle name has changed. That's the case for libraries that are available as OSGi bundles in Maven Central which are now consumed as-is rather than being rebundled by Orbit. as was done in the past. Here is a good technique for that. In the Repository Explorer, switch to Export Mode and choose to view java.package capabilities.
Search for any package:
Double click the package to see the IU details and from that you can see which bundle provides that package:
If folks think something is missing, they should ask about it here: |
- org.apache.commons.logging -> org.apache.commons.commons-logging eclipse-simrel/simrel.build#438
- org.apache.commons.logging -> org.apache.commons.commons-logging eclipse-simrel/simrel.build#438
- jakarta.el -> jakarta.el-api - jakarta.servlet -> jakarta.servlet-api - jakarta.servlet.jsp -> jakarta.servlet.jsp-api - javax.mail -> jakarta.mail-api - javax.xml.rpc -> javax.xml.rpc-api - javax.xml.soap -> jakarta.xml.soap-api - javax.wsdl 1.6.3 - javax.jws -> jakarta.jws-api - jakarta.xml.bind -> jakarta.xml.bind-api - javax.xml.stream delete - javax.xml.ws -> jakarta.xml.ws-api - org.junit4 -> org.junit eclipse-simrel/simrel.build#438
- javax.xml delete - java_cup-runtime delete - available in org.apache.xalan - org.apache.bcel delete - not needed eclipse-simrel/simrel.build#438
- javax.wsdl 1.6.3 - javax.persistence -> jakarta.persistence-api eclipse-simrel/simrel.build#438
|
SimRel 2024-09 M1 and M2 seem to suffer from incompatible versions of apache commons logging. I've filed bug eclipse-orbit/orbit-simrel#40 . Is this an issue that belongs here (I see some MRs regarding apache commons logging)? |
- javax.xml delete - java_cup-runtime delete - available in org.apache.xalan - org.apache.bcel delete - not needed eclipse-simrel/simrel.build#438
In order to ensure we can address any problems, e.g., CVEs, that might arise in 3rd party bundles in the future, we need to be prepared to update those dependencies. The following dependencies are not currently part of the restructured Orbit aggregation and need to be investigated to determine where and why these outdated versions are being used:
-[1.0.4,2.0.0) - org.eclipse.wst.server.preview /1.3.0.v202311130434 - Web Tools Platform
-1.0.4 - org.eclipse.wst.xsl.jaxp.debug /1.1.100.v202202230212 - Web Tools Platform
The above list was produced by adding validation repositories to both validation sets in simrel.aggr
and specifying to exclude all IUs available from a validation repository:
With this approach, the analysis editors view shows only the subset of 3rd party libraries that do not come from the restructured Orbit aggregation:
The text was updated successfully, but these errors were encountered: